Sync from SUSE:SLFO:1.1 openCryptoki revision 8c4e76323b612c79cb1f2a028df5a527

2025-04-15 22:35:17 +02:00
6 changed files with 63 additions and 151 deletions
--- a/ocki-3.23-remove-make-install-chgrp.patch
+++ b/ocki-3.23-remove-make-install-chgrp.patch
@@ -1,26 +1,21 @@
--- a/Makefile.am	2024-09-11 08:46:18.000000000 +0200
-+++ b/Makefile.am	2024-09-20 11:31:30.709823171 +0200
-@@ -51,19 +51,9 @@
+--- Makefile.am	2023-05-15 14:42:55.000000000 +0200
+++ Makefile-3.21.am	2023-05-25 17:13:36.266936832 +0200
+@@ -39,14 +39,9 @@
 include doc/doc.mk
 
 install-data-hook:
-if AIX
-	lsgroup $(pkcs_group) > /dev/null || $(GROUPADD) -a pkcs11
-	lsuser $(pkcsslotd_user) > /dev/null || $(USERADD) -g $(pkcs_group) -d $(DESTDIR)$(RUN_PATH)/opencryptoki -c "Opencryptoki pkcsslotd user" $(pkcsslotd_user)
-else
 -	getent group $(pkcs_group) > /dev/null || $(GROUPADD) -r $(pkcs_group)
-	getent passwd $(pkcsslotd_user) >/dev/null || $(USERADD) -r -g $(pkcs_group) -d $(RUN_PATH)/opencryptoki -s /sbin/nologin -c "Opencryptoki pkcsslotd user" $(pkcsslotd_user)
-endif
- 	$(MKDIR_P) $(DESTDIR)$(RUN_PATH)/opencryptoki/
-	$(CHOWN) $(pkcsslotd_user):$(pkcs_group) $(DESTDIR)$(RUN_PATH)/opencryptoki/
-	$(CHGRP) $(pkcs_group) $(DESTDIR)$(RUN_PATH)/opencryptoki/
- 	$(CHMOD) 0710 $(DESTDIR)$(RUN_PATH)/opencryptoki/
+-	getent passwd $(pkcsslotd_user) >/dev/null || $(USERADD) -r -g $(pkcs_group) -d /run/opencryptoki -s /sbin/nologin -c "Opencryptoki pkcsslotd user" $(pkcsslotd_user)
+ 	$(MKDIR_P) $(DESTDIR)/run/opencryptoki/
+-	$(CHOWN) $(pkcsslotd_user):$(pkcs_group) $(DESTDIR)/run/opencryptoki/
+-	$(CHGRP) $(pkcs_group) $(DESTDIR)/run/opencryptoki/
+ 	$(CHMOD) 0710 $(DESTDIR)/run/opencryptoki/
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki
 	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki
 if ENABLE_LIBRARY
 	$(MKDIR_P) $(DESTDIR)$(libdir)/opencryptoki/stdll
-@@ -83,19 +73,15 @@
+@@ -66,19 +61,15 @@
 endif
 if ENABLE_PKCSHSM_MK_CHANGE
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/HSM_MK_CHANGE
@@ -29,7 +24,7 @@
 endif
 if ENABLE_CCATOK
 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
- 		ln -fs libpkcs11_cca.$(SHLIBEXT) PKCS11_CCA.$(SHLIBEXT)
+ 		ln -fs libpkcs11_cca.so PKCS11_CCA.so
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ccatok
@@ -40,9 +35,9 @@
 	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/ccatok
 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/ccatok.conf || $(INSTALL) -m 644 $(srcdir)/usr/lib/cca_stdll/ccatok.conf $(DESTDIR)$(sysconfdir)/opencryptoki/ccatok.conf || true
-@@ -104,12 +90,9 @@
+@@ -87,12 +78,9 @@
 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
- 		ln -fs libpkcs11_ep11.$(SHLIBEXT) PKCS11_EP11.$(SHLIBEXT)
+ 		ln -fs libpkcs11_ep11.so PKCS11_EP11.so
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/ep11tok
@@ -53,9 +48,16 @@
 	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/ep11tok
 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/ep11tok.conf || $(INSTALL) -m 644 $(srcdir)/usr/lib/ep11_stdll/ep11tok.conf $(DESTDIR)$(sysconfdir)/opencryptoki/ep11tok.conf || true
-@@ -123,24 +106,18 @@
+@@ -100,30 +88,24 @@
+ endif
+ if ENABLE_P11SAK
+ 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
+-	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g $(pkcs_group) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL)  -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ endif
+ if ENABLE_ICATOK
 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
- 		ln -fs libpkcs11_ica.$(SHLIBEXT) PKCS11_ICA.$(SHLIBEXT)
+ 		ln -fs libpkcs11_ica.so PKCS11_ICA.so
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/lite
@@ -67,7 +69,7 @@
 endif
 if ENABLE_SWTOK
 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
- 		ln -fs libpkcs11_sw.$(SHLIBEXT) PKCS11_SW.$(SHLIBEXT)
+ 		ln -fs libpkcs11_sw.so PKCS11_SW.so
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok/TOK_OBJ
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/swtok
@@ -78,9 +80,9 @@
 	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/swtok
 endif
 if ENABLE_TPMTOK
-@@ -148,10 +125,8 @@
+@@ -131,10 +113,8 @@
 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
- 		ln -fs libpkcs11_tpm.$(SHLIBEXT) PKCS11_TPM.$(SHLIBEXT)
+ 		ln -fs libpkcs11_tpm.so PKCS11_TPM.so
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/tpm
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/tpm
 	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/tpm
@@ -89,9 +91,9 @@
 	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/tpm
 endif
 if ENABLE_ICSFTOK
-@@ -159,10 +134,8 @@
+@@ -142,16 +122,14 @@
 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
- 		ln -fs libpkcs11_icsf.$(SHLIBEXT) PKCS11_ICSF.$(SHLIBEXT)
+ 		ln -fs libpkcs11_icsf.so PKCS11_ICSF.so
 	$(MKDIR_P) $(DESTDIR)$(localstatedir)/lib/opencryptoki/icsf
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(localstatedir)/lib/opencryptoki/icsf
 	$(CHMOD) 0770 $(DESTDIR)$(localstatedir)/lib/opencryptoki/icsf
@@ -100,9 +102,16 @@
 	$(CHMOD) 0770 $(DESTDIR)$(lockdir)/icsf
 endif
 if ENABLE_DAEMON
-@@ -181,7 +154,6 @@
- 	@echo "--------------------------------------------------------------"
+ 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
+ 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
+-	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g $(pkcs_group) -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
+	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
 endif
+ 	$(MKDIR_P) $(DESTDIR)/etc/ld.so.conf.d
+ 	echo "$(libdir)/opencryptoki" >\
+@@ -162,7 +140,6 @@
+ 	@echo "Remember you must run ldconfig before using the above settings"
+ 	@echo "--------------------------------------------------------------"
 	$(MKDIR_P) $(DESTDIR)$(lockdir) $(DESTDIR)$(logdir)
 -	$(CHGRP) $(pkcs_group) $(DESTDIR)$(lockdir) $(DESTDIR)$(logdir)
 	$(CHMOD) 0770 $(DESTDIR)$(lockdir) $(DESTDIR)$(logdir)
--- a/ocki-3.24-remove-group-from-tests.patch
+++ b/ocki-3.24-remove-group-from-tests.patch
@@ -1,20 +0,0 @@
--- a/Makefile.am	2024-09-11 08:46:18.000000000 +0200
-+++ b/Makefile.am	2024-11-21 10:54:29.857466931 +0100
-@@ -117,7 +117,7 @@
- endif
- if ENABLE_P11SAK
- 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
-	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g $(pkcs_group) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
-+	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
- endif
- if ENABLE_ICATOK
- 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
-@@ -168,7 +168,7 @@
- if ENABLE_DAEMON
- 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
- 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || $(INSTALL) -m 644 $(srcdir)/usr/sbin/pkcsslotd/opencryptoki.conf $(DESTDIR)$(sysconfdir)/opencryptoki/opencryptoki.conf || true
-	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -g $(pkcs_group) -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
-+	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || $(INSTALL) -m 640 -o root -T $(srcdir)/doc/strength-example.conf $(DESTDIR)$(sysconfdir)/opencryptoki/strength.conf || true
- endif
- if !AIX
- 	$(MKDIR_P) $(DESTDIR)/etc/ld.so.conf.d
--- a/openCryptoki-3.23.0.tar.gz
+++ b/openCryptoki-3.23.0.tar.gz
--- a/openCryptoki-3.24.0.tar.gz
+++ b/openCryptoki-3.24.0.tar.gz
--- a/openCryptoki.changes
+++ b/openCryptoki.changes
@@ -1,69 +1,3 @@
-------------------------------------------------------------------
-Wed Dec 11 07:35:28 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
- Moved pkcshsm_mk_change from openCryptoki-devel to openCryptoki
-        (jsc#PED-10291, jsc#PED-10290)
-
-------------------------------------------------------------------
-Tue Dec 10 08:13:46 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
-  * Changed attributes - %attr(0640,root,%{pkcs_group}) - of files below:
-    - %{_sysconfdir}/opencryptoki/strength.conf
-    - %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf
-
-------------------------------------------------------------------
-Mon Nov 25 11:42:14 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
- Amended the .spec file (jsc#PED-10291, jsc#PED-10290)
- Improved handling of user/group. use existing user/group if they
-  exist. create user/group if not (bsc#1225876)
- Applied additional patch
-  * ocki-3.24-remove-group-from-tests.patch
-
-------------------------------------------------------------------
-Fri Oct  4 08:11:35 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
- Amended the .spec file (jsc#PED-10241) 
- Updated the %configure flags for i586
- Implemented a logic to exclude i586 arch
-
-------------------------------------------------------------------
-Fri Sep 20 08:33:19 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>
-
- Upgrade openCryptoki to version 3.24
-   (jsc#PED-10291, jsc#PED-10290, jsc#PED-10241)
-  * Add support for building Opencryptoki on the IBM AIX platform
-  * Add support for the CCA token on non-IBM Z platforms (x86_64, ppc64)
-  * Add support for protecting tokens with a token specific user group
-  * EP11: Add support for combined CKA_EXTRACTABLE and CKA_IBM_PROTKEY_EXTRACTABLE
-  * CCA: Add support for Koblitz curve secp256k1. Requires CCA v7.2 or later
-  * CCA: Add support for IBM Dilithium (CKM_IBM_DILITHIUM). 
-    - On Linux on IBM Z: Requires CCA v7.1 or later for Round2-65, and 
-    CCA v8.0 for the Round 3 variants. 
-    - On other platforms: 
-    Requires CCA v7.2.43 or later for Round2-65, the Round 3 variants are currently not supported
-  * CCA: Add support for RSA-OAEP with SHA224, SHA384, and SHA512 on en-/decrypt. 
-    - Requires CCA v8.1 or later on Linux on IBM Z, not supported on other platforms
-  * CCA: Add support for PKCS#11 v3.0 SHA3 mechanisms. 
-    - Requires CCA v8.1 on Linux on IBM Z, not supported on other platforms
-  * ICA: Support new libica AES-GCM api using the KMA instruction on z14 and later
-  * ICA/Soft/ICSF: Add support for PKCS#11 v3.0 SHA3 mechanisms
-  * ICA/Soft: Add support for SHA based key derivation mechanisms
-  * ICA/Soft: Add support for CKD_*_SP800 KDFs for ECDH
-  * EP11/CCA/ICA/Soft: Add support for CKA_ALWAYS_AUTHENTICATE
-  * EP11/CCA: Support live guest relocation for protected key (PKEY) operations
-  * Soft: Experimental support for IBM Dilithium via OpenSSL OQS provider
-  * ICSF: Add support for SHA-2 mechanisms
-  * ICSF: Performance improvements for attribute retrieval
-  * p11sak: Add support for exporting a key or certificate as URI-PEM file
-  * p11sak: Import/export of IBM Dilithium keys in 'oqsprovider' format PEM files
-  * p11sak: Add option to show the master key verification patterns of secure keys
-  * Bug fixes
- Amended the .spec file
- Removed obsolete patch ocki-3.23-remove-make-install-chgrp.patchi
- Added a new patch ocki-3.24-remove-make-install-chgrp.patch
-
 -------------------------------------------------------------------
 Thu Jul 18 06:07:40 UTC 2024 - Nikolay Gueorguiev <nikolay.gueorguiev@suse.com>

--- a/openCryptoki.spec
+++ b/openCryptoki.spec
@@ -27,7 +27,7 @@
 %define oc_cvs_tag opencryptoki

 Name:           openCryptoki
-Version:        3.24.0
+Version:        3.23.0
 Release:        0
 Summary:        An Implementation of PKCS#11 (Cryptoki) v2.11 for IBM Cryptographic Hardware
 License:        CPL-1.0
@@ -39,8 +39,7 @@ Source2:        openCryptoki-TFAQ.html
 Source3:        openCryptoki-rpmlintrc
 # Patch 0 is needed because group pkcs11 doesn't exist in the build environment
 # and because we don't want(?) various file and directory permissions to be 0700.
-Patch000:       ocki-3.24-remove-make-install-chgrp.patch
-Patch001:       ocki-3.24-remove-group-from-tests.patch
+Patch000:       ocki-3.23-remove-make-install-chgrp.patch
 #
 #
 BuildRequires:  bison
@@ -52,7 +51,7 @@ BuildRequires:  libitm1
 BuildRequires:  libtool
 BuildRequires:  libudev-devel
 BuildRequires:  openldap2-devel
-BuildRequires:  openssl-devel >= 1.1.1
+BuildRequires:  openssl-devel >= 1.0
 BuildRequires:  pkgconfig
 BuildRequires:  trousers-devel
 BuildRequires:  pkgconfig(systemd)
@@ -68,27 +67,25 @@ Provides:       group(pkcs11)
 ExclusiveArch:  %{openCryptoki_32bit_arch} %{openCryptoki_64bit_arch}
 %{?systemd_requires}
 %ifarch s390 s390x
-BuildRequires:  libica-devel >= 3.3
+BuildRequires:  libica-devel
 BuildRequires:  libica-tools
 %endif

 %description
-Opencryptoki implements the PKCS#11 specification v2.20 for a set of
-cryptographic hardware, such as IBM 4764 and 4765 crypto cards, and the
-Trusted Platform Module (TPM) chip. Opencryptoki also brings a software
-token implementation that can be used without any cryptographic
-hardware.
-This package contains the Slot Daemon (pkcsslotd) and general utilities.
+The PKCS#11 version 2.11 API implemented for the IBM cryptographic
+cards. This package includes support for the IBM 4758 cryptographic
+coprocessor (with the PKCS#11 firmware loaded) and the IBM eServer
+Cryptographic Accelerator (FC 4960 on pSeries).

 %package devel
 Summary:        Development files for openCryptoki, a PKCS#11 implementation for IBM hardware
 Group:          Development/Languages/C and C++
 Requires:       glibc-devel
-Requires:       libopenssl-devel >= 1.1.1
+Requires:       libopenssl-devel
 Requires:       openldap2-devel
 Requires:       trousers-devel
 %ifarch s390 s390x
-Requires:       libica-devel >= 3.3
+Requires:       libica-devel
 %endif

 %description devel
@@ -96,9 +93,6 @@ The PKCS#11 version 2.01 API implemented for the IBM cryptographic
 cards. This package includes support for the IBM 4758 cryptographic
 co-processor (with the PKCS#11 firmware loaded) and the IBM eServer
 Cryptographic Accelerator (FC 4960 on pSeries).
-This package contains the development header files for building
-opencryptoki and PKCS#11 based applications
-

 %ifarch %{openCryptoki_32bit_arch}
 %package 32bit
@@ -142,7 +136,7 @@ Cryptographic Accelerator (FC 4960 on pSeries).

 %prep
 # setup -q -n %{oc_cvs_tag}-%{version}
-%autosetup -p 1 -n %{oc_cvs_tag}-%{version}
+%autosetup -p 0 -n %{oc_cvs_tag}-%{version}

 cp %{SOURCE2} .

@@ -156,13 +150,9 @@ cp %{SOURCE2} .
    --enable-locks \
 %endif
 %ifarch s390 s390x
-    --enable-icatok --enable-ccatok --enable-ep11tok --enable-pkcsep11_migrate
+    --enable-pkcsep11_migrate
 %else
-%ifnarch i586
-    --disable-icatok --enable-ccatok --disable-ep11tok --disable-pkcsep11_migrate --enable-pkcscca_migrate
-%else
-    --disable-icatok --disable-ccatok --disable-ep11tok --disable-pkcsep11_migrate --disable-pkcscca_migrate
-%endif
+    --disable-ccatok
 %endif

 make %{?_smp_mflags}
@@ -192,7 +182,7 @@ rm -f %{buildroot}%{_libdir}/opencryptoki/methods
 # openCryptoki    pkcs11:x:64:
 # openCryptoki    pkcsslotd:x:64:
 getent group %{pkcs_group} 2>/dev/null || %{_sbindir}/groupadd -g %{pkcs11_group_id} -r %{pkcs_group} 2>/dev/null || true
-getent passwd pkcsslotd 2>/dev/null || %{_sbindir}/useradd -g %{pkcs_group} -r pkcsslotd -s /sbin/nologin -d /run/opencryptoki 2>/dev/null || true
+getent passwd pkcsslotd 2>/dev/null || %{_sbindir}/useradd -g %{pkcs11_group_id} -r pkcsslotd -s /sbin/nologin -d /run/opencryptoki 2>/dev/null || true
 %{_sbindir}/usermod -a -G %{pkcs_group} root

 %preun
@@ -223,7 +213,6 @@ if [ -L %{_sysconfdir}/pkcs11 ] ; then
 	rm %{_sysconfdir}/pkcs11
 fi
 %{service_del_postun pkcsslotd.service}
-/sbin/ldconfig

 %post 32bit
 # Old library name links
@@ -261,37 +250,36 @@ ln -sf %{_libdir}/opencryptoki/libopencryptoki.so %{_prefix}/lib/pkcs11/PKCS11_A
  # configuration directory
 %dir %{_sysconfdir}/opencryptoki
 %config %{_sysconfdir}/opencryptoki/opencryptoki.conf
-%attr(0640,root,%{pkcs_group}) %config %{_sysconfdir}/opencryptoki/strength.conf
-%attr(0640,root,%{pkcs_group}) %config %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf
+%config %attr(640,root,%{pkcs_group}) %{_sysconfdir}/opencryptoki/strength.conf
+%config %attr(640,root,%{pkcs_group}) %{_sysconfdir}/opencryptoki/p11sak_defined_attrs.conf
 %ifarch s390 s390x
+%config %{_sysconfdir}/opencryptoki/ccatok.conf
 %config %{_sysconfdir}/opencryptoki/ep11cpfilter.conf
 %config %{_sysconfdir}/opencryptoki/ep11tok.conf
-%endif
-%ifarch s390 s390x
 %{_sbindir}/pkcsep11_migrate
-%{_sbindir}/pkcsep11_session
 %endif
 %{_sbindir}/p11sak
 %{_unitdir}/pkcsslotd.service
 %{_tmpfilesdir}/opencryptoki.conf
 %{_sbindir}/rcpkcsslotd
  # utilities
-%ifnarch i586
-%config %{_sysconfdir}/opencryptoki/ccatok.conf
+%ifarch s390 s390x
+%{_sbindir}/pkcsep11_session
 %{_sbindir}/pkcscca
-%dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki/ccatok
-%dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki/ccatok/TOK_OBJ
 %endif
 %{_sbindir}/pkcsslotd
 %{_sbindir}/pkcsconf
 %{_sbindir}/pkcsicsf
 %{_sbindir}/pkcsstats
 %{_sbindir}/pkcstok_migrate
-%{_sbindir}/pkcstok_admin
 %dir %{_libdir}/opencryptoki
 %dir %{_libdir}/opencryptoki/stdll
  # State and lock directories
 %dir %attr(755,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki
+%ifarch s390 s390x
+%dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki/ccatok
+%dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki/ccatok/TOK_OBJ
+%endif
 %dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki/swtok
 %dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki/swtok/TOK_OBJ
 %dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/lib/opencryptoki/tpm
@@ -304,13 +292,14 @@ ln -sf %{_libdir}/opencryptoki/libopencryptoki.so %{_prefix}/lib/pkcs11/PKCS11_A
 %endif
 %dir %attr(770,root,%{pkcs_group}) %{_localstatedir}/log/opencryptoki/
 %{_mandir}/man*/*
-%{_sbindir}/pkcshsm_mk_change

 %files devel
 %dir %{_libdir}/opencryptoki
 %dir %{_libdir}/opencryptoki/stdll
 %{_includedir}/opencryptoki
 %{_libdir}/pkgconfig/opencryptoki.pc
+###
+%{_sbindir}/pkcshsm_mk_change

 %ifarch %{openCryptoki_32bit_arch}
 %files 32bit