diff --git a/openvpn.changes b/openvpn.changes
index 846ac4a..cc7f008 100644
--- a/openvpn.changes
+++ b/openvpn.changes
@@ -16,6 +16,7 @@ Tue Jun  6 14:59:29 CEST 2017 - ndas@suse.de
    *openvpn-2.3.x-fixed-multiple-low-severity-issues.patch
    *openvpn-fips140-2.3.2.patch]
 - pkcs11-helper-devel >= 1.11 is needed for openvpn-2.4.2
+- cleanup the spec file
 
 -------------------------------------------------------------------
 Fri Apr 21 14:55:09 CEST 2017 - ndas@suse.de
diff --git a/openvpn.spec b/openvpn.spec
index 47574ad..78db079 100644
--- a/openvpn.spec
+++ b/openvpn.spec
@@ -147,14 +147,14 @@ sed -e "s|\" __DATE__|$(date '+%b %e %Y' -r version.m4)\"|g" \
 sed -e "s|@PLUGIN_LIBDIR@|%{_libdir}/openvpn/plugins|g" \
     -e "s|@PLUGIN_DOCDIR@|%{_defaultdocdir}/%{name}|g" \
     -i doc/openvpn.8
-sed -e "s|/var/run|%{_rundir}|g" < \
+sed -e "s|%{_localstatedir}/run|%{_rundir}|g" < \
     $RPM_SOURCE_DIR/%{name}.service > %{name}.service
 
 # %%doc items shouldn't be executable.
 find contrib sample -type f -exec chmod a-x \{\} \;
 
 %build
-export CFLAGS="$RPM_OPT_FLAGS $(getconf LFS_CFLAGS) -W -Wall -fno-strict-aliasing"
+export CFLAGS="%{optflags} $(getconf LFS_CFLAGS) -W -Wall -fno-strict-aliasing"
 export LDFLAGS
 %configure \
 	--enable-iproute2		\
@@ -169,14 +169,14 @@ export LDFLAGS
 	--enable-plugin-auth-pam	\
 	CFLAGS="$CFLAGS $(getconf LFS_CFLAGS) -fPIE $PLUGIN_DEFS"	\
 	LDFLAGS="$LDFLAGS -pie -lpam -rdynamic -Wl,-rpath,%{_libdir}/%{name}/plugins"
-make
+make %{_smp_mflags}
 
 %install
 make DESTDIR=$RPM_BUILD_ROOT install
-find $RPM_BUILD_ROOT -name '*.la' | xargs rm -f
-mkdir -p $RPM_BUILD_ROOT/%{_sysconfdir}/openvpn
-mkdir -p $RPM_BUILD_ROOT/%{_rundir}/openvpn
-mkdir -p $RPM_BUILD_ROOT/%{_datadir}/openvpn
+find %{buildroot} -type f -name "*.la" -delete -print
+mkdir -p %{buildroot}/%{_sysconfdir}/openvpn
+mkdir -p %{buildroot}/%{_rundir}/openvpn
+mkdir -p %{buildroot}/%{_datadir}/openvpn
 %if %{with_systemd}
 rm %{buildroot}%{_libdir}/systemd/system/openvpn-client@.service
 rm %{buildroot}%{_libdir}/systemd/system/openvpn-server@.service
@@ -187,36 +187,36 @@ install -D -m 755 $RPM_SOURCE_DIR/rc%{name} %{buildroot}%{_sbindir}/rc%{name}
 mkdir -p %{buildroot}%{_libdir}/tmpfiles.d
 install -m 0644 $RPM_SOURCE_DIR/%{name}-tmpfile.conf %{buildroot}%{_libdir}/tmpfiles.d/%{name}.conf
 %else
-install -D -m 755 $RPM_SOURCE_DIR/openvpn.init $RPM_BUILD_ROOT/%{_sysconfdir}/init.d/openvpn
-ln -sv %{_sysconfdir}/init.d/openvpn $RPM_BUILD_ROOT/%{_sbindir}/rcopenvpn
+install -D -m 755 $RPM_SOURCE_DIR/openvpn.init %{buildroot}/%{_sysconfdir}/init.d/openvpn
+ln -sv %{_sysconfdir}/init.d/openvpn %{buildroot}/%{_sbindir}/rcopenvpn
 # the /etc/sysconfig/openvpn template only with sysvinit, no needed with systemd
-install -d -m0755 %{buildroot}/var/adm/fillup-templates
+install -d -m0755 %{buildroot}%{_localstatedir}/adm/fillup-templates
 install    -m0600 $RPM_SOURCE_DIR/openvpn.sysconfig \
-                  %{buildroot}/var/adm/fillup-templates/sysconfig.openvpn
+                  %{buildroot}%{_localstatedir}/adm/fillup-templates/sysconfig.openvpn
 %endif
 cp -p $RPM_SOURCE_DIR/openvpn.README.SUSE README.SUSE
 install -m 755 $RPM_SOURCE_DIR/client-netconfig.up sample/sample-scripts/client-netconfig.up
 install -m 755 $RPM_SOURCE_DIR/client-netconfig.down sample/sample-scripts/client-netconfig.down
 
 # we install docs via spec into _defaultdocdir/name/management-notes.txt
-rm -rf $RPM_BUILD_ROOT%{_datadir}/doc/{OpenVPN,%name}
+rm -rf %{buildroot}%{_datadir}/doc/{OpenVPN,%{name}}
 find sample -name .gitignore | xargs rm -f
 
 %post
 %if %{with_systemd}
-systemd-tmpfiles --create /usr/lib64/tmpfiles.d/%{name}.conf ||:
+systemd-tmpfiles --create %{_libdir}/tmpfiles.d/%{name}.conf ||:
 %service_add_post %{name}.target
 # try to migrate openvpn.service autostart to openvpn@<CONF>.service
 if test ${FIRST_ARG:-$1} -ge 1 -a \
 	-x /bin/systemctl -a \
-	-f /etc/sysconfig/openvpn -a \
-	-f /var/adm/fillup-templates/sysconfig.openvpn && \
+	-f %{_sysconfdir}/sysconfig/openvpn -a \
+	-f %{_localstatedir}/adm/fillup-templates/sysconfig.openvpn && \
 	/bin/systemctl --quiet is-enabled openvpn.service &>/dev/null ;
 then
-	. /etc/sysconfig/openvpn
+	. %{_sysconfdir}/sysconfig/openvpn
 	try_service_cgroup_join()
 	{
-		local p="/var/run/openvpn/${1}.pid"
+		local p="%{_localstatedir}/run/openvpn/${1}.pid"
 		local t="/sys/fs/cgroup/systemd/system/openvpn@.service/${1}"
 		/sbin/checkproc -p "$p" "%{_sbindir}/openvpn" &>/dev/null || return 0
 		test -d "$t" || mkdir -p "$t" 2>/dev/null || return 1
@@ -224,22 +224,22 @@ then
 	}
 	if test "X$OPENVPN_AUTOSTART" != "X" ; then
 		for conf in $OPENVPN_AUTOSTART ; do
-			test -f "/etc/openvpn/${conf}.conf" && \
+			test -f "%{_sysconfdir}/openvpn/${conf}.conf" && \
 			/bin/systemctl enable "openvpn@${conf}.service" && \
 			try_service_cgroup_join "$conf" || continue
 		done
 	else
 		shopt -s nullglob || :
-		for conf in /etc/openvpn/*.conf ; do
+		for conf in %{_sysconfdir}/openvpn/*.conf ; do
 			conf=${conf##*/}
 			conf=${conf%.conf}
-			test -f "/etc/openvpn/${conf}.conf" && \
+			test -f "%{_sysconfdir}/openvpn/${conf}.conf" && \
 			/bin/systemctl enable "openvpn@${conf}.service" && \
 			try_service_cgroup_join "$conf" || continue
 		done
 	fi
 fi
-rm -f /etc/sysconfig/openvpn || :
+rm -f %{_sysconfdir}/sysconfig/openvpn || :
 %else
 %{?fillup_and_insserv:%fillup_and_insserv}
 %endif
@@ -278,7 +278,7 @@ rm -f /etc/sysconfig/openvpn || :
 %dir %attr(0750,root,root) %ghost %{_rundir}/openvpn/
 %else
 %config %{_sysconfdir}/init.d/openvpn
-/var/adm/fillup-templates/sysconfig.openvpn
+%{_localstatedir}/adm/fillup-templates/sysconfig.openvpn
 %dir %attr(750,root,root) %{_rundir}/openvpn/
 %endif
 %{_sbindir}/rcopenvpn