Sync changes to SLFO-1.2 branch

2025-08-20 13:59:55 +02:00
9 changed files with 393 additions and 36 deletions
--- a/0001-hardened-Introduce-hardened-profile.patch
+++ b/0001-hardened-Introduce-hardened-profile.patch
@@ -0,0 +1,26 @@
+From 27182273c10c84e30789f478be8d83817ab2d40a Mon Sep 17 00:00:00 2001
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+Date: Mon, 3 Feb 2025 17:00:49 -0500
+Subject: [PATCH] hardened: Introduce hardened profile
+
+This profile provides an easy way to enable some basic Linux kernel
+hardening techniques for security-focused users.
+---
+ profiles/hardened/tuned.conf |   11 +++++++++++
+ 1 file changed, 11 insertions(+)
+ create mode 100644 profiles/hardened/tuned.conf
+
+--- /dev/null
+++ b/profiles/hardened/tuned.conf
+@@ -0,0 +1,11 @@
+#
+# tuned configuration
+#
+
+[main]
+summary=Enable basic Linux kernel hardening techniques
+
+[bootloader]
+cmdline=hardened_usercopy=on init_on_free=1 init_on_alloc=1 page_poison=on page_table_check=on
+description=Read kernel parameter documentation for details.
+    This could introduce slight (less than 5%) network performance penalties on extreme workloads.
--- a/0001-tuned-consts-Fix-grub.cfg-path-in-SLE.patch
+++ b/0001-tuned-consts-Fix-grub.cfg-path-in-SLE.patch
@@ -0,0 +1,27 @@
+From e5f4a3bb82eb64081af16c49d68260233c55396c Mon Sep 17 00:00:00 2001
+From: Gabriel Krisman Bertazi <krisman@suse.de>
+Date: Mon, 27 Jan 2025 16:08:22 -0500
+Subject: [PATCH] tuned/consts: Fix grub.cfg path in SLE
+
+Out of tree patch.  Tuned hardcodes the grub.cfg path to a Red
+Hat-specific symlink.  Replace it with the direct /boot path.
+---
+ tuned/consts.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tuned/consts.py b/tuned/consts.py
+index 4606aee..63ca10f 100644
+--- a/tuned/consts.py
+++ b/tuned/consts.py
+@@ -31,7 +31,7 @@ ERROR_THRESHOLD = 3
+ 
+ # bootloader plugin configuration
+ BOOT_DIR = "/boot"
+-GRUB2_CFG_FILES = ["/etc/grub2.cfg", "/etc/grub2-efi.cfg"]
+GRUB2_CFG_FILES = ["/boot/grub2/grub.cfg", "/etc/grub2-efi.cfg", ]
+ GRUB2_CFG_DIR = "/etc/grub.d"
+ GRUB2_TUNED_TEMPLATE_NAME = "00_tuned"
+ GRUB2_TUNED_TEMPLATE_PATH = GRUB2_CFG_DIR + "/" + GRUB2_TUNED_TEMPLATE_NAME
+-- 
+2.47.0
+
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                <param name="url">https://github.com/redhat-performance/tuned</param>
-              <param name="changesrevision">86ac9777981db7880a614ff21908ecbeb611e1ba</param></service></servicedata>
+              <param name="changesrevision">889387b0001b783514523162de21af406e31a549</param></service></servicedata>
--- a/tuned-2.22.1.2+git.86ac977.obscpio
+++ b/tuned-2.22.1.2+git.86ac977.obscpio
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:96a0d0a7ec538ccbea46cda1d765c307c637efed4b7910c21a88d86cd2ca7583
-size 1116172
--- a/tuned-2.25.1.0+git.889387b.obscpio
+++ b/tuned-2.25.1.0+git.889387b.obscpio
--- a/tuned.changes
+++ b/tuned.changes
@@ -1,3 +1,233 @@
+-------------------------------------------------------------------
+Mon Jun  2 08:53:25 UTC 2025 - Thomas Renninger <trenn@suse.de>
+
+- Fix newlines in changelog
+
+-------------------------------------------------------------------
+Mon May 12 20:13:17 UTC 2025 - Gabriel Krisman Bertazi <gabriel.bertazi@suse.com>
+
+- Add hardened profile (PED-12781)
+A 0001-hardened-Introduce-hardened-profile.patch
+
+-------------------------------------------------------------------
+Wed Mar 26 22:30:46 UTC 2025 - Thomas Renninger <trenn@suse.de>
+
+- Add BuildRequires:
+  * gobject-introspection-devel for test in check section to succeed
+  * pyinotify in ppd
+
+-------------------------------------------------------------------
+Fri Mar 14 13:22:08 UTC 2025 - Bruno Pitrus <brunopitrus@hotmail.com>
+
+- tuned-ppd: add missing requirement on `asyncore` python library
+
+-------------------------------------------------------------------
+Tue Feb 04 10:43:48 UTC 2025 - trenn@suse.de
+
+- Add LIBEXECDIR=%{_prefix}/lib to adopt libexecdir and remove
+  the sed hack in spec due to mainline git 410344b8dbc64bada45be
+- Update to version 2.25.1.0+git.889387b:
+  * new release (2.25.1)
+  * disk: Add missing remove parameter
+  * plugins: Add missing instance parameters
+  * Makefile: Add support for installation to custom $LIBEXECDIR
+  * new release (2.25.0)
+  * plugin_scheduler: add switch to disable processing of kthreads
+  * sap-hana: Set transparent_hugepages to madvise
+  * bootloader: export Grub variables to make them available in submenus
+  * functions: Create a new parser object for each string expansion
+  * utils: Rename `PluginLoader` to `ClassLoader`
+  * plugin_net: handle cqe-mode-rx ethtool option
+  * profiles: Correct CPU governor settings
+  * utils.commands: Fix CPU online detection when not present
+  * new release (2.25.0-rc.1)
+  * docs: fixed docs generation on centos-7
+  * plugin_scheduler: fixed API
+  * plugin_scheduler: make perf support optional
+  * plugin_net: added support for hotplug and rename
+  * scheduler: Postpone cgroup blacklist check and double-check after fail
+  * makefile: added support for installation to custom $BINDIR/$SBINDIR
+  * tuned-ppd: Do not always clear holds with TuneD profile change signal
+  * tuned-ppd: Check that TuneD profile change signal is relevant
+  * doc: enable documentation generation on RHEL with asciidoc
+  * scheduler: Log process info when its affinity cannot be changed
+
+-------------------------------------------------------------------
+Mon Jan 27 21:33:57 UTC 2025 - Gabriel Krisman Bertazi <gabriel.bertazi@suse.com>
+
+- Fix grub.cfg path (bsc#1236491)
+A 0001-tuned-consts-Fix-grub.cfg-path-in-SLE.patch
+
+-------------------------------------------------------------------
+Wed Jan 22 15:27:18 UTC 2025 - Dominique Leuenberger <dimstar@opensuse.org>
+
+- Drop rcFOO symlinks for CODE16 (PED-266).
+
+-------------------------------------------------------------------
+Fri Jan 17 07:21:34 UTC 2025 - trenn@suse.de
+
+- Update to version 2.24.1.50+git.13dfc68:
+  * scheduler: updated sched knobs for kernels 6.6+
+  * plugin_cpu: allow raw energy_performance_preference values
+  * Do not initialize kvm low latency if kvm not present
+- Do not conflict with power-profiles-daemon, this is managed via
+  ppd-service in the tuned-ppd subpackage (bsc#1234754)
+
+-------------------------------------------------------------------
+Thu Jan 16 08:31:46 UTC 2025 - trenn@suse.de
+
+- Update to version 2.24.1.44+git.cc168b9:
+  * tuned-ppd: Remove the use of StrEnum
+  * tuned-ppd: Disallow releasing profile holds of other processes
+  * tuned-ppd: Unify polkit policy with power-profiles-daemon
+  * Obsolete power-profiles-daemon
+  * Document new vm plugin options
+  * Adjust profiles to set dirty_(bytes|ratio) via the vm plugin
+  * vm: Add support for dirty_(bytes|ratio) sysctl parameters
+  * tuned-ppd: Support the new UPower PPD namespace
+  * tuned-ppd: Enable changing profile via function keys
+  * tuned-ppd: Use inotify to check for performance degradation
+  * tuned-ppd: Require the presence of the balanced profile
+  * tuned-ppd: Add the version property
+  * tuned-ppd: Add docstrings
+  * tuned-ppd: Keep track of active and base profile
+  * tuned-ppd: Fix UPower signal handler initialization
+  * Add variables to BLS entries only if grub is used
+  * powertop2tuned: use default user profile path from the consts
+  * tuned-ppd: Use effective hold profile when adding profile holds
+  * Bump doc/manual revision date and number
+  * Clean up plugin docstrings
+  * Add a script for generation of plugin docs from docstrings
+  * scheduler: Do not assume that perf events have type attribute
+  * Fix the error in the raise statement of check_positive()
+  * fix: expand variables in Plugin._verify_all_device_commands
+  * Allow shared service drop-in directory
+  * drop support for cpuspeed
+  * Parse no_turbo cpu plugin option using commands.get_bool
+
+-------------------------------------------------------------------
+Tue Dec 17 19:11:54 UTC 2024 - Mel Gorman <mgorman@suse.com>
+
+- Move gobject dependency to gtk package as it is the only utility that
+  imports gi.
+
+-------------------------------------------------------------------
+Tue Dec 17 17:52:42 UTC 2024 - Mel Gorman <mgorman@suse.com>
+
+- Remove unnecessary cpupower dependency, sysfs fallback is used instead.
+
+-------------------------------------------------------------------
+Thu Nov 28 16:27:49 UTC 2024 - trenn@suse.de
+
+- Fix below security issues found by SUSE security review of latest
+  polkit API additions. Kudos go to Matthias Gerstner (bsc#1232412)
+- fixed privileged execution of arbitrary scripts by active local user
+  resolves: CVE-2024-52336
+- added sanity checks for API methods parameters
+   resolves: CVE-2024-52337
+- Update to version 2.24.1.0+git.90c24ee:
+  * new release (2.24.1)
+  * spec: used macro for profiles path and other fixes
+  * realtime: remove leftover use of tuna
+
+-------------------------------------------------------------------
+Sat Oct 26 12:45:09 UTC 2024 - Thomas Renninger <trenn@suse.de>
+
+- Correct service cleanup calls in preun and postun scripts
+- Move tmpfile_create before service_add_post
+- Added python3-pyudev and python3-dbus-python as BuildRequires
+  for added check section
+- Move user defined profiles
+  from /etc/tuned/
+  into subdirs /etc/tuned/PROFILE
+  via spec's %post routine
+- Enable make test in check section
+- Update has at least parts of jsc#PED-10695
+
+-------------------------------------------------------------------
+Sun Aug 25 17:28:21 UTC 2024 - pallaswept@proton.me
+
+- Migrate profiles to /etc/tuned/profiles/ and /usr/lib/tuned/profiles/ 
+  * Per upstream #615 and #609
+
+- Update to version 2.24.0.2+git.c082797:
+  * controller init: set _on_battery before switching profile
+
+- New release (2.24.0)
+  * Clear plugin repository when stopping tuning
+  * man: add description of the balanced-battery profile
+
+- New release (2.24.0-rc.1)
+  * chore: remove dead irqbalance functions
+  * plugin_irqbalance: switch to IRQBALANCE_BANNED_CPULIST
+  * hotplug: wait for device initialization
+  * Add `functions` to the files copied by the release-cp Makefile target
+  * Add package2cpus and packages2uncores matcher functions
+  * uncore: Allow to configure frequency limits using percent
+  * plugin_scheduler: Adjust error logging in _set_affinity
+  * fix: expand variables in plugin_irq
+  * tests: Restore TuneD service after the error messages test
+  * tests: Do not run tunedDisableSystemdRateLimitingStart via rlRun
+  * Enable controller reset for audio by default
+  * tuned-ppd: Adjust log message emitted when battery status changes
+  * tuned-ppd: Refactor daemon initialization
+  * tuned-ppd: Remove magic constant "unknown"
+  * Add support for controlling amd-pstate core performance boost
+  * spec: Start tuned-ppd right away if swapping from active PPD
+  * spec: Add standard systemd scriptlet macros for tuned-ppd
+  * tuned-ppd: Remove PIDFile from the systemd service file
+  * tuned-ppd: Add an option to log to a file
+  * Install script functions and recommend.d to /usr/lib/tuned/
+  * Rename TUNED_PROFILESDIR to TUNED_PROFILES_DIR
+  * CNF-13015: Fix helper function not accessing the correct return result
+  * CNF-13015: Add helper function to run `lscpu` and parse result using regex 
+    parameters - This is similar to the cpuinfo function that reads from 
+    /proc/cpuinfo - Unfortunately that function was insufficient for our needs 
+    as we need to identify both the Vendor and Architecture reliably
+
+-------------------------------------------------------------------
+Sat Jun 22 15:29:45 UTC 2024 - tobi.goergens@gmail.com
+
+- Update to version 2.23.0.2+git.5d5dbfc:
+  * chore: remove use of deprecated Logger.warn()
+  * new release (2.23.0)
+  * Disk plugin: make hdparm device checks lazy
+  * Revert "Video plugin: make hdparm device checks lazy"
+  * Video plugin: make hdparm device checks lazy
+  * Do not check for x86_energy_perf_policy if it won't be used
+  * Check that writes are necessary if they may cause redundant IPIs
+  * Add an option to skip `write_to_file` if the content would not change
+  * Turn on amdgpu panel power savings in balanced-battery
+  * Modify the video plugin for tuning of the amdgpu `panel_power_savings` attribute
+  * video: Don't show error when trying to read radeon files
+  * video: make missing radeon_powersave files quieter
+  * video: Rename _radeon_powersave_files to _files
+  * feat: add plugin_irq
+  * throughput-performance: dropped unused AMD related variable
+  * ppd: Adjust the detection of 'performance-degraded'
+  * ppd: Fix hold releasing
+  * ppd: Add debug logs when changing base profile
+  * Re-check dbus when (re)starting TuneD from tuned-adm profile
+  * functions: added 'log' which helps with debugging
+  * Simplify reading/writing from/to sysctl by using existing functions
+  * Fix logs in `commands.read_file`
+  * plugin_cpu: decrease the severity of _has_pm_qos==False
+  * sap-netweaver: increased vm.max_map_count
+  * daemon: buffer sighup signal
+  * tuned-ppd: Detect battery change events
+  * Migrate profiles to /etc/tuned/profiles/ and /usr/lib/tuned/profiles/
+  * Propagate unexpected exceptions in the wait exception handler
+  * Add an option to configure profile directories
+  * Use get_list to parse unix_socket_signal_path
+  * Add a function to parse lists in the global configuration
+  * Added intel_recommended_pstate builtin function.
+  * dbus: add commands to dynamically create/destroy instances
+  * dbus: ensure that hotplug operations only work on hotplug plugins
+  * instance: add priority as a property
+  * monitor_net: fixed traceback if stats cannot be read
+  * plugin_net: do not read monitors if dynamic tuning is disabled
+  * Allow equal characters in parameter value
+
 -------------------------------------------------------------------
 Thu Feb 29 11:37:09 UTC 2024 - trenn@suse.de

@@ -44,13 +274,11 @@ Sun Feb 11 18:29:24 UTC 2024 - trenn@suse.de
  * Fix TextView to expand with window

 -------------------------------------------------------------------
-
 Mon Dec 04 11:28:35 CET 2023 - aschnell@suse.com

 - do not package inoperable plugins (bsc#1217758)

 -------------------------------------------------------------------
-
 Wed Nov 15 09:42:09 UTC 2023 - trenn@suse.de

 - Update to version 2.21.0.17+git.5d3b469:
@@ -65,7 +293,6 @@ Wed Nov 15 09:42:09 UTC 2023 - trenn@suse.de
  * Converted SPEC file license to SPDX

 -------------------------------------------------------------------
-
 Fri Sep 15 15:27:32 UTC 2023 - trenn@suse.de

 - Update to version 2.21.0.0+git.670541d:
--- a/tuned.obsinfo
+++ b/tuned.obsinfo
@@ -1,4 +1,4 @@
 name: tuned
-version: 2.22.1.2+git.86ac977
-mtime: 1709055039
-commit: 86ac9777981db7880a614ff21908ecbeb611e1ba
+version: 2.25.1.0+git.889387b
+mtime: 1738610220
+commit: 889387b0001b783514523162de21af406e31a549
--- a/tuned.rpmlintrc
+++ b/tuned.rpmlintrc
@@ -1,3 +1,4 @@
 addFilter("E: zero-length /etc/tuned/active_profile")
 addFilter("E: zero-length /etc/tuned/profile_mode")
 addFilter("E: zero-length /etc/tuned/post_loaded_profile")
+addFilter("E: zero-length /etc/tuned/ppd_base_profile")
--- a/tuned.spec
+++ b/tuned.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package tuned
 #
-# Copyright (c) 2024 SUSE LLC
+# Copyright (c) 2025 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,9 +16,10 @@
 #


-%define         profile_dir %{_prefix}/lib/%{name}
+%define         system_dir %{_prefix}/lib/%{name}/
+%define         profile_dir %{system_dir}profiles/
 Name:           tuned
-Version:        2.22.1.2+git.86ac977
+Version:        2.25.1.0+git.889387b
 Release:        0
 Summary:        A dynamic adaptive system tuning daemon
 License:        GPL-2.0-or-later
@@ -29,13 +30,18 @@ Source1:        tuned.rpmlintrc
 # PATCH-FIX-OPENSUSE fix-allow-receive_sender-default.patch <allow receive_sender="com.redhat.com"/> allow receive_* is normally
 # not needed as that is the default --<p.drouand@gmail.com>
 Patch0:         fix-allow-receive_sender-default.patch
+Patch1:         0001-tuned-consts-Fix-grub.cfg-path-in-SLE.patch
+Patch2:         0001-hardened-Introduce-hardened-profile.patch
 BuildRequires:  bash-completion
 BuildRequires:  desktop-file-utils
+BuildRequires:  gobject-introspection-devel
 BuildRequires:  pkgconfig
 BuildRequires:  python3-base
+BuildRequires:  python3-dbus-python
+# needed by check section
+BuildRequires:  python3-pyudev
 BuildRequires:  pkgconfig(systemd)
 # need perf_bias now
-Requires:       cpupower >= 4.19
 Requires:       ethtool
 Requires:       gawk
 Requires:       hdparm
@@ -43,11 +49,13 @@ Requires:       polkit
 Requires:       python3-configobj
 Requires:       python3-dbus-python
 Requires:       python3-decorator
-Requires:       python3-gobject
 Requires:       python3-linux-procfs
+Requires:       python3-pyinotify
 Requires:       python3-pyudev
 Requires:       util-linux
 Requires:       virt-what
+Conflicts:      laptop-mode-tools
+Conflicts:      tlp
 BuildArch:      noarch
 %{?systemd_requires}

@@ -86,6 +94,7 @@ Summary:        Disk and net statistic monitoring systemtap scripts - GTK GUI
 Group:          System/Base
 Requires:       %{name} = %{version}
 Requires:       powertop
+Requires:       python3-gobject

 %description gtk
 GTK GUI that can control tuned and provide simple profile editor.
@@ -98,6 +107,16 @@ Requires:       %{name} = %{version}
 %description profiles-atomic
 Additional profile(s) for the tuned daemon, targeted to Atomic host and guest.

+%package profiles-security
+Summary:        Security related tuned daemon profiles
+Group:          System/Base
+Requires:       %{name} = %{version}
+
+%description profiles-security
+Security tuning collection providing tuned profiles related to system security and hardening.
+These profiles typically provide a set of security settings that belong and should be applied
+together. They can be combined with other profiles via include= statement as needed.
+
 %package profiles-nfv
 Summary:        Additional tuned profiles targeted to Network Function Virtualization (NFV)
 Group:          System/Base
@@ -166,18 +185,31 @@ Requires:       %{name} = %{version}
 %description profiles-spectrumscale
 Additional tuned profile(s) optimized for IBM Spectrum Scale.

+%package ppd
+Summary:        PPD compatibility daemon
+Requires:       %{name} = %{version}
+Requires:       python3-pyasyncore
+Requires:       python3-pyinotify
+Conflicts:      ppd-service
+# The compatibility daemon is swappable for power-profiles-daemon
+Provides:       ppd-service
+
+%description ppd
+An API translation daemon that allows applications to easily transition
+to TuneD from power-profiles-daemon (PPD).
+
 %prep
 %autosetup -p1

 %build
 # The tuned daemon is written in pure Python. Nothing requires to be built.
 # Just a hack to avoid installation in a wrong directory
-sed -i 's|usr/libexec/tuned|%{profile_dir}|' Makefile
 sed -i 's|$(SYSCONFDIR)/modprobe.d|%{_modprobedir}|' Makefile
 sed -i 's|$(SYSCONFDIR)/dbus-1/system.d|%{_datadir}/dbus-1/system.d|' Makefile

 %install
-%make_install TUNED_PROFILESDIR=%{profile_dir}
+%make_install LIBEXECDIR=%{_prefix}/lib TUNED_PROFILES_DIR=%{profile_dir}
+make install-ppd DESTDIR=%{buildroot} TUNED_PROFILES_DIR=%{profile_dir}
 # we do not have the python perf module (see bsc #1217758)
 rm %{buildroot}/%{python3_sitelib}/tuned/plugins/plugin_{scheduler,irqbalance}.py
 %py3_compile %{buildroot}/%{python3_sitelib}
@@ -185,25 +217,43 @@ rm -rf %{buildroot}/%{_datadir}/doc
 # Remove unwanted stuff instead of excluding them in files list
 rm -rf %{buildroot}%{profile_dir}/{default,desktop-powersave,laptop-ac-powersave,server-powersave,laptop-battery-powersave,enterprise-storage,spindown-disk}
 rm %{buildroot}%{_mandir}/man7/tuned-profiles-compat.7
+%if 0%{?suse_version} < 1600
 ln -sf service %{buildroot}%{_sbindir}/rctuned
+%endif

 %if 0%{?sle_version} && %{?suse_version} < 1599
-rm -r %{buildroot}%{_prefix}/lib/tuned/sap-netweaver
-rm -r %{buildroot}%{_prefix}/lib/tuned/sap-hana
+rm -r %{buildroot}%{profile_dir}/sap-netweaver
+rm -r %{buildroot}%{profile_dir}/sap-hana
 rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap.7
 rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap-hana.7
 %endif

+%check
+make test PYTHON=python3
+
 %post
-%service_add_post %{name}.service
-%tmpfiles_create %{_tmpfilesdir}/%{name}.conf
+%tmpfiles_create %{name}.conf
+%systemd_post %{name}.service
+
+# migrate all user-defined profiles from /etc/tuned/ to /etc/tuned/profiles/
+for f in %{_sysconfdir}/tuned/*; do
+  if [ -e "$f/tuned.conf" ]; then
+    mv -n "$f" %{_sysconfdir}/tuned/profiles/
+  fi
+done
+
+%post ppd
+%systemd_post %{name}-ppd.service

 %pre
-%service_add_pre %{name}.service
+%systemd_pre %{name}.service
 # Avoid restoring outdated stuff in posttrans
 [ ! -f "%{_sysconfdir}/modprobe.d/tuned.conf.rpmsave" ] || \
  mv -f "%{_sysconfdir}/modprobe.d/tuned.conf.rpmsave" "%{_sysconfdir}/modprobe.d/tuned.conf.rpmsave.old" || :

+%pre ppd
+%systemd_pre %{name}-ppd.service
+
 %posttrans
 # Migration of modprobe.conf files to _modprobedir
 [ ! -f "%{_sysconfdir}/modprobe.d/tuned.conf.rpmsave" ] || \
@@ -212,9 +262,15 @@ rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap-hana.7
 %preun
 %service_del_preun %{name}.service

+%preun ppd
+%service_del_preun %{name}-ppd.service
+
 %postun
 %service_del_postun %{name}.service

+%postun ppd
+%service_del_postun %{name}-ppd.service
+
 %files
 %license COPYING
 %doc AUTHORS README.md
@@ -223,29 +279,33 @@ rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap-hana.7
 %{python3_sitelib}/tuned
 %{_sbindir}/tuned
 %{_sbindir}/tuned-adm
+%if 0%{?suse_version} < 1600
 %{_sbindir}/rctuned
-%dir %{profile_dir}
-%dir %{profile_dir}/recommend.d
+%endif
+%dir %{system_dir}
+%dir %{system_dir}/recommend.d
 %exclude %{python3_sitelib}/tuned/gtk

 # General files
-%{profile_dir}/pmqos-static.py
-%{profile_dir}/functions
-%{profile_dir}/recommend.d/50-tuned.conf
-%{profile_dir}/defirqaffinity.py
+%{system_dir}/pmqos-static.py
+%{system_dir}/functions
+%{system_dir}/recommend.d/50-tuned.conf
+%{system_dir}/defirqaffinity.py

 %if 0%{?sle_version} && %{?suse_version} < 1599
-%exclude %{_prefix}/lib/tuned/sap-netweaver
-%exclude %{_prefix}/lib/tuned/sap-hana
-%exclude %{_prefix}/lib/tuned/sap-hana-kvm-guest
+%exclude %{profile_dir}/sap-netweaver
+%exclude %{profile_dir}/sap-hana
+%exclude %{profile_dir}/sap-hana-kvm-guest
 %exclude %{_mandir}/man7/tuned-profiles-sap.7%{?ext_man}
 %exclude %{_mandir}/man7/tuned-profiles-sap-hana.7%{?ext_man}
 %endif

 # Profiles included in main package - alphabetically sorted
+%dir %{profile_dir}
 %{profile_dir}/accelerator-performance
 %{profile_dir}/aws
 %{profile_dir}/balanced
+%{profile_dir}/balanced-battery
 %{profile_dir}/cpu-partitioning
 %{profile_dir}/cpu-partitioning-powersave
 %{profile_dir}/desktop
@@ -263,15 +323,17 @@ rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap-hana.7

 # active_profile might be empty when built via build service, but typically
 # not on a real install -> better do not mark it %%ghost
-%config(noreplace) %verify(not size mtime md5) %{_sysconfdir}/tuned/active_profile
+%config(noreplace) %{_sysconfdir}/tuned/active_profile
+%config(noreplace) %{_sysconfdir}/tuned/ppd_base_profile
 %config(noreplace) %{_sysconfdir}/tuned/cpu-partitioning-variables.conf
 %config(noreplace) %{_sysconfdir}/tuned/cpu-partitioning-powersave-variables.conf
 %config(noreplace) %{_sysconfdir}/tuned/tuned-main.conf
 %config(noreplace) %{_sysconfdir}/tuned/profile_mode
+%config(noreplace) %{_sysconfdir}/tuned/profiles
 %config(noreplace) %{_sysconfdir}/tuned/post_loaded_profile
 %config(noreplace) %verify(not size mtime md5) %{_sysconfdir}/tuned/bootcmdline
-%{_sysconfdir}/grub.d
-%{_tmpfilesdir}/tuned.conf
+%config %{_sysconfdir}/grub.d
+%{_tmpfilesdir}/%{name}.conf
 %{_unitdir}/tuned.service
 %{_modprobedir}/tuned.conf
 %{_datadir}/dbus-1/system.d/com.redhat.tuned.conf
@@ -314,6 +376,9 @@ rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap-hana.7
 %{profile_dir}/atomic-guest
 %{_mandir}/man7/tuned-profiles-atomic.7%{?ext_man}

+%files profiles-security
+%{profile_dir}/hardened
+
 %files profiles-realtime
 %config(noreplace) %{_sysconfdir}/tuned/realtime-variables.conf
 %{profile_dir}/realtime
@@ -332,12 +397,12 @@ rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap-hana.7

 %files profiles-postgresql
 %defattr(-,root,root,-)
-%{_prefix}/lib/tuned/postgresql
+%{profile_dir}/postgresql
 %{_mandir}/man7/tuned-profiles-postgresql.7*

 %files profiles-spectrumscale
 %defattr(-,root,root,-)
-%{_prefix}/lib/tuned/spectrumscale-ece
+%{profile_dir}/spectrumscale-ece
 %{_mandir}/man7/tuned-profiles-spectrumscale-ece.7*

 %files profiles-openshift
@@ -363,4 +428,15 @@ rm %{buildroot}%{_mandir}/man7/tuned-profiles-sap-hana.7
 %{_mandir}/man8/diskdevstat.*
 %{_mandir}/man8/scomes.*

+%files ppd
+%{_sbindir}/tuned-ppd
+%{_unitdir}/tuned-ppd.service
+%{_datadir}/dbus-1/system-services/net.hadess.PowerProfiles.service
+%{_datadir}/dbus-1/system.d/net.hadess.PowerProfiles.conf
+%{_datadir}/polkit-1/actions/net.hadess.PowerProfiles.policy
+%{_datadir}/dbus-1/system-services/org.freedesktop.UPower.PowerProfiles.service
+%{_datadir}/dbus-1/system.d/org.freedesktop.UPower.PowerProfiles.conf
+%{_datadir}/polkit-1/actions/org.freedesktop.UPower.PowerProfiles.policy
+%config(noreplace) %{_sysconfdir}/tuned/ppd.conf
+
 %changelog