diff --git a/condor-tmpfiles.conf b/condor-tmpfiles.conf
index 101060b..68d259a 100644
--- a/condor-tmpfiles.conf
+++ b/condor-tmpfiles.conf
@@ -1 +1,2 @@
 d /var/run/condor 0775 condor condor -
+d /var/lock/condor 0775 condor condor -
diff --git a/condor.spec b/condor.spec
index 185cf6b..b9569bc 100644
--- a/condor.spec
+++ b/condor.spec
@@ -917,14 +917,14 @@ rm -rf %{buildroot}
 %dir %_var/lib/condor/execute/
 %dir %_var/log/condor/
 %dir %_var/lib/condor/spool/
-#%if %systemd
-#%ghost %dir %_var/lock/condor/
-#%ghost %dir %_var/run/condor/
-#%else
+%if %systemd
+%ghost %dir %_var/lock/condor/
+%ghost %dir %_var/run/condor/
+%else
 %dir %_var/lock/condor
 %dir %_var/lock/condor/local
 %dir %_var/run/condor
-#%endif
+%endif
 
 %_libexecdir/condor/accountant_log_fixer
 %_datadir/condor/libcondorapi.so
@@ -1155,6 +1155,7 @@ if [ $? = 0 ]; then
    #restorecon -R -v /var/lock/condor
    setsebool -P condor_domain_can_network_connect 1
    semanage port -a -t condor_port_t -p tcp 12345
+   # we will need to open more ports :-( 
    # the number of extraneous SELinux warnings on f17 is very high
 fi