diff --git a/openarc.spec b/openarc.spec
index 2cc49fa..f328b4c 100644
--- a/openarc.spec
+++ b/openarc.spec
@@ -6,7 +6,7 @@
 Summary: An open source library and milter for providing ARC service
 Name: openarc
 Version: 1.0.0
-Release: %{?pre_rel:0.}7%{?pre_rel:.%pre_rel}%{?dist}.1
+Release: %{?pre_rel:0.}8%{?pre_rel:.%pre_rel}%{?dist}
 License: BSD and Sendmail
 URL: https://github.com/trusteddomainproject/OpenARC
 
@@ -73,18 +73,17 @@ autoreconf --install
 %install
 %make_install
 mkdir -p -m 0700 %{buildroot}%{_sysconfdir}/%{name}
-mkdir -p -m 0700 %{buildroot}%{_localstatedir}/run/%{name}
+mkdir -p -m 0750 %{buildroot}%{_rundir}/%{name}
 rm -r %{buildroot}%{_prefix}/share/doc/openarc
 rm %{buildroot}/%{_libdir}/*.la
 
 
 cat > %{buildroot}%{_sysconfdir}/openarc.conf <<EOF
 ## See openarc.conf(5) or %{_docdir}/%{name}%{?rhel:-%{version}}/openarc.conf.sample for more
-PidFile %{_localstatedir}/run/%{name}/%{name}.pid
+PidFile %{_rundir}/%{name}/%{name}.pid
 Syslog  yes
-#Umask   002
 UserID  openarc:openarc
-Socket  local:%{_localstatedir}/run/%{name}/%{name}.sock
+Socket  local:%{_rundi}/%{name}/%{name}.sock
 SignHeaders to,subject,message-id,date,from,mime-version,dkim-signature
 PeerList %{_sysconfdir}/%{name}/PeerList
 MilterDebug 6
@@ -118,12 +117,15 @@ After=network.target nss-lookup.target syslog.target
 
 [Service]
 Type=forking
-PIDFile=%{_localstatedir}/run/%{name}/%{name}.pid
+PIDFile=%{_rundir}/%{name}/%{name}.pid
 EnvironmentFile=-%{_sysconfdir}/sysconfig/%{name}
 ExecStart=/usr/sbin/%{name} $OPTIONS
 ExecReload=/bin/kill -USR1 $MAINPID
 User=%{name}
 Group=%{name}
+UMask=0007
+ProtectSystem=strict
+ProtectHome=true
 
 [Install]
 WantedBy=multi-user.target
@@ -136,19 +138,19 @@ install -m 0755 contrib/init/redhat/%{name} %{buildroot}%{_initrddir}/%{name}
 %if %{tmpfiles}
 install -p -d %{buildroot}%{_tmpfilesdir}
 cat > %{buildroot}%{_tmpfilesdir}/%{name}.conf <<EOF
-D %{_localstatedir}/run/%{name} 0700 %{name} %{name} -
+D %{_rundir}/%{name} 0750 %{name} %{name} -
 EOF
 %endif
 
 %pre
-if ! getent passwd openarc >/dev/null 2>&1; then
-    %{_sbindir}/useradd -M -d %{_localstatedir}/lib/%{name} -r -s /sbin/nologin openarc
-    if ! getent group openarc >/dev/null; then
-        %{_sbindir}/groupadd openarc
-        %{_sbindir}/usermod -g openarc openarc
+if ! getent passwd %{name} >/dev/null 2>&1; then
+    %{_sbindir}/useradd -M -d %{_localstatedir}/lib/%{name} -r -s /sbin/nologin %{name}
+    if ! getent group %{name} >/dev/null; then
+        %{_sbindir}/groupadd %{name}
+        %{_sbindir}/usermod -g %{name} %{name}
     fi
     if getent group mail >/dev/null; then
-        %{_sbindir}/usermod -G mail openarc
+        %{_sbindir}/usermod -G mail %{name}
     fi
 fi
 exit 0
@@ -178,15 +180,15 @@ exit 0
 
 %files
 %license LICENSE LICENSE.Sendmail
-%doc README RELEASE_NOTES openarc/openarc.conf.sample
-%dir %attr(-,%{name},%{name}) %{_sysconfdir}/%{name}
-%config(noreplace) %attr(-,%{name},%{name}) %{_sysconfdir}/%{name}.conf
-%config(noreplace) %attr(-,%{name},%{name}) %{_sysconfdir}/%{name}/PeerList
+%doc README RELEASE_NOTES %{name}/%{name}.conf.sample
+%dir %attr(0755,root,%{name}) %{_sysconfdir}/%{name}
+%config(noreplace) %attr(0644,root,%{name}) %{_sysconfdir}/%{name}.conf
+%config(noreplace) %attr(0440,%{name},%{name}) %{_sysconfdir}/%{name}/PeerList
 
 %if %{tmpfiles}
 %{_tmpfilesdir}/%{name}.conf
 %else
-%dir %attr(-,%{name},%{name}) %{_localstatedir}/run/%{name}
+%dir %attr(0750,%{name},%{name}) %{_rundir}/%{name}
 %endif
 
 %if %{systemd}
@@ -209,6 +211,11 @@ exit 0
 %{_libdir}/pkgconfig/*.pc
 
 %changelog
+* Tue Apr 21 2020 Matt Domsch <mdomsch@fedoraproject.org> - 1.0.0-0.8.Beta3
+- packaging suggestions from
+  https://github.com/trusteddomainproject/OpenARC/pull/103#issuecomment-574367733
+- use systemd service ProtectHome and ProtectSystem
+
 * Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.0.0-0.7.Beta3.1
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild