diff --git a/cockpit.changes b/cockpit.changes
index 7838615..1c89532 100644
--- a/cockpit.changes
+++ b/cockpit.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Wed Aug 12 09:33:17 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
+
+- Require group wheel
+- Add permission macros [bsc#1169614]
+- Create tmpfiles in %post install
+
 -------------------------------------------------------------------
 Fri Jun 26 12:09:09 UTC 2020 - Ludwig Nussel <lnussel@suse.de>
 
diff --git a/cockpit.spec b/cockpit.spec
index cd814d2..bcab607 100644
--- a/cockpit.spec
+++ b/cockpit.spec
@@ -467,11 +467,13 @@ Summary: Cockpit Web Service
 Requires: glib-networking
 Requires: openssl
 Requires: glib2 >= 2.37.4
+Requires: group(wheel)
 Conflicts: firewalld < 0.6.0-1
 Recommends: sscg >= 2.3
 Recommends: system-logos
 Requires: systemd >= 235
 Suggests: sssd-dbus
+Requires(pre): permissions
 Requires(post): systemd
 Requires(preun): systemd
 Requires(postun): systemd
@@ -534,6 +536,8 @@ getent group cockpit-wsinstance >/dev/null || groupadd -r cockpit-wsinstance
 getent passwd cockpit-wsinstance >/dev/null || useradd -r -g cockpit-wsinstance -d /nonexisting -s /sbin/nologin -c "User for cockpit-ws instances" cockpit-wsinstance
 
 %post ws
+%set_permissions %{_libexecdir}/cockpit-session
+%tmpfiles_create cockpit-tempfiles.conf
 %systemd_post cockpit.socket
 # firewalld only partially picks up changes to its services files without this
 test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true
@@ -545,6 +549,9 @@ test -f %{_bindir}/firewall-cmd && firewall-cmd --reload --quiet || true
 %systemd_postun_with_restart cockpit.socket
 %systemd_postun_with_restart cockpit.service
 
+%verifyscript ws
+%verify_permissions -e %{_libexecdir}/cockpit-session
+
 # -------------------------------------------------------------------------------
 # Sub-packages that are part of cockpit-system in RHEL/CentOS, but separate in Fedora