diff --git a/.criu.metadata b/.criu.metadata
new file mode 100644
index 0000000..81d32f2
--- /dev/null
+++ b/.criu.metadata
@@ -0,0 +1 @@
+a3598bc51ee354d7300b9862be92dc9f41e8b372 SOURCES/criu-3.10.tar.bz2
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..a736559
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+SOURCES/criu-3.10.tar.bz2
diff --git a/SOURCES/1-2-Fix-building-with-4.18.patch b/SOURCES/1-2-Fix-building-with-4.18.patch
new file mode 100644
index 0000000..93bbe65
--- /dev/null
+++ b/SOURCES/1-2-Fix-building-with-4.18.patch
@@ -0,0 +1,241 @@
+From patchwork Mon Jul  9 06:28:26 2018
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: [1/2] Fix building with 4.18
+From: Adrian Reber <adrian@lisas.de>
+X-Patchwork-Id: 8849
+Message-Id: <1531117707-8173-2-git-send-email-adrian@lisas.de>
+To: <criu@openvz.org>, Andrei Vagin <avagin@virtuozzo.com>
+Cc: Adrian Reber <areber@redhat.com>
+Date: Mon, 9 Jul 2018 06:28:26 +0000
+
+From: Adrian Reber <areber@redhat.com>
+
+Building CRIU against 4.18 fails with multiple re-definition errors.
+This has been reported upstream
+ https://lore.kernel.org/lkml/20180704142116.GM17048@lisas.de/
+but there has not been any answer yet. This tries to workaround those
+compile errors by pulling the required aio defines directly into CRIU.
+
+Signed-off-by: Adrian Reber <areber@redhat.com>
+---
+ criu/cr-check.c          |  2 +-
+ criu/include/aio.h       | 73 ++++++++++++++++++++++++++++++++++++++++++++++-
+ criu/pie/restorer.c      |  1 -
+ test/zdtm/static/aio01.c | 74 ++++++++++++++++++++++++++++++++++++++++++++++--
+ 4 files changed, 145 insertions(+), 5 deletions(-)
+
+diff --git a/criu/cr-check.c b/criu/cr-check.c
+index d3393c4..fc53afb 100644
+--- a/criu/cr-check.c
++++ b/criu/cr-check.c
+@@ -22,7 +22,6 @@
+ #include <sys/prctl.h>
+ #include <sched.h>
+ #include <sys/mount.h>
+-#include <linux/aio_abi.h>
+ 
+ #include "../soccr/soccr.h"
+ 
+@@ -51,6 +50,7 @@
+ #include "net.h"
+ #include "restorer.h"
+ #include "uffd.h"
++#include "aio.h"
+ 
+ static char *feature_name(int (*func)());
+ 
+diff --git a/criu/include/aio.h b/criu/include/aio.h
+index 9a58089..a749c47 100644
+--- a/criu/include/aio.h
++++ b/criu/include/aio.h
+@@ -1,7 +1,6 @@
+ #ifndef __CR_AIO_H__
+ #define __CR_AIO_H__
+ 
+-#include <linux/aio_abi.h>
+ #include "images/mm.pb-c.h"
+ unsigned int aio_estimate_nr_reqs(unsigned int size);
+ int dump_aio_ring(MmEntry *mme, struct vma_area *vma);
+@@ -12,6 +11,78 @@ unsigned long aio_rings_args_size(struct vm_area_list *);
+ struct task_restore_args;
+ int prepare_aios(struct pstree_item *t, struct task_restore_args *ta);
+ 
++/* copied from linux/fs.h */
++typedef int __bitwise __kernel_rwf_t;
++
++/* copied from linux/aio_abi.h */
++#ifndef COMPEL_SYSCALL_TYPES_H__
++/* The ifndef is needed to avoid a clang compiler error */
++typedef __kernel_ulong_t aio_context_t;
++#endif
++
++enum {
++	IOCB_CMD_PREAD = 0,
++	IOCB_CMD_PWRITE = 1,
++	IOCB_CMD_FSYNC = 2,
++	IOCB_CMD_FDSYNC = 3,
++	/* These two are experimental.
++	 * IOCB_CMD_PREADX = 4,
++	 * IOCB_CMD_POLL = 5,
++	 */
++	IOCB_CMD_NOOP = 6,
++	IOCB_CMD_PREADV = 7,
++	IOCB_CMD_PWRITEV = 8,
++};
++/* read() from /dev/aio returns these structures. */
++struct io_event {
++	__u64		data;		/* the data field from the iocb */
++	__u64		obj;		/* what iocb this event came from */
++	__s64		res;		/* result code for this event */
++	__s64		res2;		/* secondary result */
++};
++
++/*
++ * we always use a 64bit off_t when communicating
++ * with userland.  its up to libraries to do the
++ * proper padding and aio_error abstraction
++ */
++
++struct iocb {
++	/* these are internal to the kernel/libc. */
++	__u64	aio_data;	/* data to be returned in event's data */
++
++#if defined(__BYTE_ORDER) ? __BYTE_ORDER == __LITTLE_ENDIAN : defined(__LITTLE_ENDIAN)
++	__u32	aio_key;	/* the kernel sets aio_key to the req # */
++	__kernel_rwf_t aio_rw_flags;	/* RWF_* flags */
++#elif defined(__BYTE_ORDER) ? __BYTE_ORDER == __BIG_ENDIAN : defined(__BIG_ENDIAN)
++	__kernel_rwf_t aio_rw_flags;	/* RWF_* flags */
++	__u32	aio_key;	/* the kernel sets aio_key to the req # */
++#else
++#error edit for your odd byteorder.
++#endif
++
++	/* common fields */
++	__u16	aio_lio_opcode;	/* see IOCB_CMD_ above */
++	__s16	aio_reqprio;
++	__u32	aio_fildes;
++
++	__u64	aio_buf;
++	__u64	aio_nbytes;
++	__s64	aio_offset;
++
++	/* extra parameters */
++	__u64	aio_reserved2;	/* TODO: use this for a (struct sigevent *) */
++
++	/* flags for the "struct iocb" */
++	__u32	aio_flags;
++
++	/*
++	 * if the IOCB_FLAG_RESFD flag of "aio_flags" is set, this is an
++	 * eventfd to signal AIO readiness to
++	 */
++	__u32	aio_resfd;
++}; /* 64 bytes */
++
+ struct aio_ring {
+ 	unsigned        id;     /* kernel internal index number */
+ 	unsigned        nr;     /* number of io_events */
+diff --git a/criu/pie/restorer.c b/criu/pie/restorer.c
+index 9b7f6dd..f100213 100644
+--- a/criu/pie/restorer.c
++++ b/criu/pie/restorer.c
+@@ -3,7 +3,6 @@
+ 
+ #include <linux/securebits.h>
+ #include <linux/capability.h>
+-#include <linux/aio_abi.h>
+ #include <sys/types.h>
+ #include <sys/mman.h>
+ #include <sys/file.h>
+diff --git a/test/zdtm/static/aio01.c b/test/zdtm/static/aio01.c
+index f84fd35..4ad29a7 100644
+--- a/test/zdtm/static/aio01.c
++++ b/test/zdtm/static/aio01.c
+@@ -1,6 +1,5 @@
+-#include <linux/aio_abi.h>
++#include <linux/types.h>
+ #include <sys/syscall.h>
+-#include <sys/types.h>
+ #include <sys/stat.h>
+ #include <string.h>
+ #include <stdlib.h>
+@@ -13,6 +12,77 @@
+ const char *test_doc	= "Check head and tail restore correct";
+ const char *test_author	= "Kirill Tkhai <ktkhai@virtuozzo.com>";
+ 
++/* copied from linux/fs.h */
++typedef int __bitwise __kernel_rwf_t;
++
++/* copied from linux/aio_abi.h */
++#ifndef COMPEL_SYSCALL_TYPES_H__
++typedef __kernel_ulong_t aio_context_t;
++#endif
++
++enum {
++	IOCB_CMD_PREAD = 0,
++	IOCB_CMD_PWRITE = 1,
++	IOCB_CMD_FSYNC = 2,
++	IOCB_CMD_FDSYNC = 3,
++	/* These two are experimental.
++	 * IOCB_CMD_PREADX = 4,
++	 * IOCB_CMD_POLL = 5,
++	 */
++	IOCB_CMD_NOOP = 6,
++	IOCB_CMD_PREADV = 7,
++	IOCB_CMD_PWRITEV = 8,
++};
++/* read() from /dev/aio returns these structures. */
++struct io_event {
++	__u64		data;		/* the data field from the iocb */
++	__u64		obj;		/* what iocb this event came from */
++	__s64		res;		/* result code for this event */
++	__s64		res2;		/* secondary result */
++};
++
++/*
++ * we always use a 64bit off_t when communicating
++ * with userland.  its up to libraries to do the
++ * proper padding and aio_error abstraction
++ */
++
++struct iocb {
++	/* these are internal to the kernel/libc. */
++	__u64	aio_data;	/* data to be returned in event's data */
++
++#if defined(__BYTE_ORDER) ? __BYTE_ORDER == __LITTLE_ENDIAN : defined(__LITTLE_ENDIAN)
++	__u32	aio_key;	/* the kernel sets aio_key to the req # */
++	__kernel_rwf_t aio_rw_flags;	/* RWF_* flags */
++#elif defined(__BYTE_ORDER) ? __BYTE_ORDER == __BIG_ENDIAN : defined(__BIG_ENDIAN)
++	__kernel_rwf_t aio_rw_flags;	/* RWF_* flags */
++	__u32	aio_key;	/* the kernel sets aio_key to the req # */
++#else
++#error edit for your odd byteorder.
++#endif
++
++	/* common fields */
++	__u16	aio_lio_opcode;	/* see IOCB_CMD_ above */
++	__s16	aio_reqprio;
++	__u32	aio_fildes;
++
++	__u64	aio_buf;
++	__u64	aio_nbytes;
++	__s64	aio_offset;
++
++	/* extra parameters */
++	__u64	aio_reserved2;	/* TODO: use this for a (struct sigevent *) */
++
++	/* flags for the "struct iocb" */
++	__u32	aio_flags;
++
++	/*
++	 * if the IOCB_FLAG_RESFD flag of "aio_flags" is set, this is an
++	 * eventfd to signal AIO readiness to
++	 */
++	__u32	aio_resfd;
++}; /* 64 bytes */
++
+ struct aio_ring {
+ 	unsigned	id;     /* kernel internal index number */
+ 	unsigned	nr;     /* number of io_events */
diff --git a/SOURCES/27034e7c64b00a1f2467afb5ebb1d5b9b1a06ce1.patch b/SOURCES/27034e7c64b00a1f2467afb5ebb1d5b9b1a06ce1.patch
new file mode 100644
index 0000000..269236a
--- /dev/null
+++ b/SOURCES/27034e7c64b00a1f2467afb5ebb1d5b9b1a06ce1.patch
@@ -0,0 +1,83 @@
+From 27034e7c64b00a1f2467afb5ebb1d5b9b1a06ce1 Mon Sep 17 00:00:00 2001
+From: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Date: Wed, 11 Jul 2018 13:43:33 +0300
+Subject: [PATCH] mount: fix regression where open_mountpoint failed on
+ readonly fs
+
+If we fail to create temporary directory for doing a clean mount we can
+make mount clean reusing the code which enters new mountns to umount
+overmounts. As when last process exits mntns all mounts are implicitly
+cleaned from children, see in kernel source - sys_exit->do_exit
+->exit_task_namespaces->switch_task_namespaces->free_nsproxy
+->put_mnt_ns->umount_tree->drop_collected_mounts->umount_tree:
+
+    /* Hide the mounts from mnt_mounts */
+    list_for_each_entry(p, &tmp_list, mnt_list) {
+            list_del_init(&p->mnt_child);
+    }
+
+Fixes commit b6cfb1ce2948 ("mount: make open_mountpoint handle overmouts
+properly")
+
+https://github.com/checkpoint-restore/criu/issues/520
+Signed-off-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
+Acked-by: Adrian Reber <areber@redhat.com>
+Signed-off-by: Andrei Vagin <avagin@virtuozzo.com>
+---
+ criu/mount.c | 28 ++++++++++++++++++++--------
+ 1 file changed, 20 insertions(+), 8 deletions(-)
+
+diff --git a/criu/mount.c b/criu/mount.c
+index b56164e953..9cc8f6e940 100644
+--- a/criu/mount.c
++++ b/criu/mount.c
+@@ -1325,10 +1325,18 @@ int ns_open_mountpoint(void *arg)
+ 	if (umount_overmounts(mi))
+ 		goto err;
+ 
+-	/* Save fd which we opened for parent due to CLONE_FILES flag */
+-	*fd = get_clean_fd(mi);
+-	if (*fd < 0)
++	/*
++	 * Save fd which we opened for parent due to CLONE_FILES flag
++	 *
++	 * Mount can still have children in it, but we don't need to clean it
++	 * explicitly as when last process exits mntns all mounts in it are
++	 * cleaned from their children, and we are exactly the last process.
++	 */
++	*fd = open(mi->mountpoint, O_DIRECTORY|O_RDONLY);
++	if (*fd < 0) {
++		pr_perror("Unable to open %s", mi->mountpoint);
+ 		goto err;
++	}
+ 
+ 	return 0;
+ err:
+@@ -1367,18 +1375,22 @@ int open_mountpoint(struct mount_info *pm)
+ 
+ 	if (!mnt_is_overmounted(pm)) {
+ 		pr_info("\tmount has children %s\n", pm->mountpoint);
+-
+ 		fd = get_clean_fd(pm);
+-		if (fd < 0)
+-			goto err;
+-	} else {
++	}
++
++	/*
++	 * Mount is overmounted or probably we can't create a temporary
++	 * direcotry for a cleaned mount
++	 */
++	if (fd < 0) {
+ 		int pid, status;
+ 		struct clone_arg ca = {
+ 			.mi = pm,
+ 			.fd = &fd
+ 		};
+ 
+-		pr_info("\tmount is overmounted %s\n", pm->mountpoint);
++		pr_info("\tmount is overmounted or has children %s\n",
++				pm->mountpoint);
+ 
+ 		/*
+ 		 * We are overmounted - not accessible in a regular way. We
diff --git a/SOURCES/c321cc07607cfe4215fc90e426ae4491fca4c49c.patch b/SOURCES/c321cc07607cfe4215fc90e426ae4491fca4c49c.patch
new file mode 100644
index 0000000..7ac5679
--- /dev/null
+++ b/SOURCES/c321cc07607cfe4215fc90e426ae4491fca4c49c.patch
@@ -0,0 +1,58 @@
+From c321cc07607cfe4215fc90e426ae4491fca4c49c Mon Sep 17 00:00:00 2001
+From: Adrian Reber <areber@redhat.com>
+Date: Thu, 22 Nov 2018 13:44:03 +0000
+Subject: [PATCH] Fix kerndat_link_nsid() on systems with more than 10
+ interfaces
+
+On a system with more than 10 network interfaces the link_nsid check
+fails:
+
+$ criu check --feature link_nsid
+Warn  (criu/cr-check.c:1237): NSID isn't supported
+
+The function kerndat_link_nsid() uses:
+
+ nde.ifindex = 10;
+
+This fails as there is already an interface with ifindex 10.
+
+This patch moves the creation of the socket into the second network
+namespace and the feature check succeeds.
+
+Suggested-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: Adrian Reber <areber@redhat.com>
+Signed-off-by: Andrei Vagin <avagin@gmail.com>
+---
+ criu/net.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/criu/net.c b/criu/net.c
+index ec66d1e6c3..c1a6e3094f 100644
+--- a/criu/net.c
++++ b/criu/net.c
+@@ -3148,12 +3148,6 @@ int kerndat_link_nsid()
+ 		};
+ 		int nsfd, sk, ret;
+ 
+-		sk = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+-		if (sk < 0) {
+-			pr_perror("Unable to create a netlink socket");
+-			exit(1);
+-		}
+-
+ 		if (unshare(CLONE_NEWNET)) {
+ 			pr_perror("Unable create a network namespace");
+ 			exit(1);
+@@ -3168,6 +3162,12 @@ int kerndat_link_nsid()
+ 			exit(1);
+ 		}
+ 
++		sk = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
++		if (sk < 0) {
++			pr_perror("Unable to create a netlink socket");
++			exit(1);
++		}
++
+ 		nde.type = ND_TYPE__VETH;
+ 		nde.name = "veth";
+ 		nde.ifindex = 10;
diff --git a/SOURCES/criu-tmpfiles.conf b/SOURCES/criu-tmpfiles.conf
new file mode 100644
index 0000000..66cc5bf
--- /dev/null
+++ b/SOURCES/criu-tmpfiles.conf
@@ -0,0 +1 @@
+d /run/criu 0755 root root -
diff --git a/SOURCES/f44f8ef6e4d594bd74c041e25261bf275e52621b.patch b/SOURCES/f44f8ef6e4d594bd74c041e25261bf275e52621b.patch
new file mode 100644
index 0000000..55aaae4
--- /dev/null
+++ b/SOURCES/f44f8ef6e4d594bd74c041e25261bf275e52621b.patch
@@ -0,0 +1,33 @@
+From f44f8ef6e4d594bd74c041e25261bf275e52621b Mon Sep 17 00:00:00 2001
+From: Adrian Reber <areber@redhat.com>
+Date: Thu, 29 Nov 2018 09:24:01 +0000
+Subject: [PATCH] Do not lock network if running in the host network namespace
+
+Related: https://github.com/checkpoint-restore/criu/issues/577
+
+Restoring a runc container which is running in the host's network
+namespace locked the network (iptables-restore) without unlocking it.
+
+This disables network logging if running in the host's network
+namespace.
+
+Suggested-by: Andrei Vagin <avagin@gmail.com>
+Signed-off-by: Adrian Reber <areber@redhat.com>
+Signed-off-by: Andrei Vagin <avagin@gmail.com>
+---
+ criu/cr-restore.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/criu/cr-restore.c b/criu/cr-restore.c
+index 6086d65238..d8fe352a63 100644
+--- a/criu/cr-restore.c
++++ b/criu/cr-restore.c
+@@ -2135,7 +2135,7 @@ static int restore_root_task(struct pstree_item *init)
+ 			goto out_kill;
+ 	}
+ 
+-	if (opts.empty_ns & CLONE_NEWNET) {
++	if (root_ns_mask & opts.empty_ns & CLONE_NEWNET) {
+ 		/*
+ 		 * Local TCP connections were locked by network_lock_internal()
+ 		 * on dump and normally should have been C/R-ed by respectively
diff --git a/SPECS/criu.spec b/SPECS/criu.spec
new file mode 100644
index 0000000..ad4940f
--- /dev/null
+++ b/SPECS/criu.spec
@@ -0,0 +1,488 @@
+%if 0%{?fedora} >= 27 || 0%{?rhel} > 7
+%global py_prefix python3
+%else
+%global py_prefix python
+%endif
+
+# With annobin enabled, CRIU does not work anymore. It seems CRIU's
+# parasite code breaks if annobin is enabled.
+%undefine _annotated_build
+
+Name: criu
+Version: 3.10
+Release: 7%{?dist}
+Provides: crtools = %{version}-%{release}
+Obsoletes: crtools <= 1.0-2
+Summary: Tool for Checkpoint/Restore in User-space
+Group: System Environment/Base
+License: GPLv2
+URL: http://criu.org/
+Source0: http://download.openvz.org/criu/criu-%{version}.tar.bz2
+# https://patchwork.criu.org/patch/8849/mbox/
+Patch1: 1-2-Fix-building-with-4.18.patch
+# Fixes errors with read-only runc
+Patch2: https://github.com/checkpoint-restore/criu/commit/27034e7c64b00a1f2467afb5ebb1d5b9b1a06ce1.patch
+# Do not lock network if running in the host network namespace
+Patch3: https://github.com/checkpoint-restore/criu/commit/f44f8ef6e4d594bd74c041e25261bf275e52621b.patch
+# Fix 'criu check --feature link_nsid' with more than 10 interfaces
+Patch4: https://github.com/checkpoint-restore/criu/commit/c321cc07607cfe4215fc90e426ae4491fca4c49c.patch
+
+%if 0%{?rhel} && 0%{?rhel} <= 7
+BuildRequires: perl
+# RHEL has no asciidoc; take man-page from Fedora 26
+# zcat /usr/share/man/man8/criu.8.gz > criu.8
+Source1: criu.8
+Source2: crit.1
+# The patch aio-fix.patch is needed as RHEL7
+# doesn't do "nr_events *= 2" in ioctx_alloc().
+Patch100: aio-fix.patch
+%endif
+
+Source3: criu-tmpfiles.conf
+
+BuildRequires: gcc
+BuildRequires: systemd
+BuildRequires: libnet-devel
+BuildRequires: protobuf-devel protobuf-c-devel %{py_prefix}-devel libnl3-devel libcap-devel
+%if 0%{?fedora} || 0%{?rhel} > 7
+BuildRequires: asciidoc xmlto
+BuildRequires: perl-interpreter
+# Checkpointing containers with a tmpfs requires tar
+Recommends: tar
+%endif
+
+# user-space and kernel changes are only available for x86_64, arm,
+# ppc64le, aarch64 and s390x
+# https://bugzilla.redhat.com/show_bug.cgi?id=902875
+ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x
+
+%description
+criu is the user-space part of Checkpoint/Restore in User-space
+(CRIU), a project to implement checkpoint/restore functionality for
+Linux in user-space.
+
+%if 0%{?fedora} || 0%{?rhel} > 7
+%package devel
+Summary: Header files and libraries for %{name}
+Group: Development/Libraries
+Requires: %{name} = %{version}-%{release}
+
+%description devel
+This package contains header files and libraries for %{name}.
+%endif
+
+%package -n %{py_prefix}-%{name}
+%{?python_provide:%python_provide %{py_prefix}-%{name}}
+Summary: Python bindings for %{name}
+Group: Development/Languages
+%if 0%{?rhel} && 0%{?rhel} <= 7
+Requires: protobuf-python
+Requires: %{name} = %{version}-%{release} %{py_prefix}-ipaddr
+%else
+Requires: %{py_prefix}-protobuf
+Obsoletes: python2-criu < 3.10-1
+%endif
+
+%description -n %{py_prefix}-%{name}
+%{py_prefix}-%{name} contains Python bindings for %{name}.
+
+%package -n crit
+Summary: CRIU image tool
+Requires: %{py_prefix}-%{name} = %{version}-%{release}
+
+%description -n crit
+crit is a tool designed to decode CRIU binary dump files and show
+their content in human-readable form.
+
+
+%prep
+%setup -q
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+
+%if 0%{?rhel} && 0%{?rhel} <= 7
+%patch100 -p1
+%endif
+
+%build
+# %{?_smp_mflags} does not work
+# -fstack-protector breaks build
+CFLAGS+=`echo %{optflags} | sed -e 's,-fstack-protector\S*,,g'` make V=1 WERROR=0 PREFIX=%{_prefix} RUNDIR=/run/criu PYTHON=%{py_prefix}
+%if 0%{?fedora} || 0%{?rhel} > 7
+make docs V=1
+%endif
+
+
+%install
+make install-criu DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
+make install-lib DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir} PYTHON=%{py_prefix}
+%if 0%{?fedora} || 0%{?rhel} > 7
+# only install documentation on Fedora as it requires asciidoc,
+# which is not available on RHEL7
+make install-man DESTDIR=$RPM_BUILD_ROOT PREFIX=%{_prefix} LIBDIR=%{_libdir}
+%else
+install -p -m 644  -D %{SOURCE1} $RPM_BUILD_ROOT%{_mandir}/man8/%{name}.8
+install -p -m 644  -D %{SOURCE2} $RPM_BUILD_ROOT%{_mandir}/man1/crit.1
+%endif
+
+mkdir -p %{buildroot}%{_tmpfilesdir}
+install -m 0644 %{SOURCE3} %{buildroot}%{_tmpfilesdir}/%{name}.conf
+install -d -m 0755 %{buildroot}/run/%{name}/
+
+%if 0%{?rhel} && 0%{?rhel} <= 7
+# remove devel package
+rm -rf $RPM_BUILD_ROOT%{_includedir}/criu
+rm $RPM_BUILD_ROOT%{_libdir}/*.so*
+rm -rf $RPM_BUILD_ROOT%{_libdir}/pkgconfig
+rm -rf $RPM_BUILD_ROOT%{_libexecdir}/%{name}
+%endif
+
+%ldconfig_scriptlets
+
+%files
+%{_sbindir}/%{name}
+%doc %{_mandir}/man8/criu.8*
+%if 0%{?fedora} || 0%{?rhel} > 7
+%{_libdir}/*.so.*
+%{_libexecdir}/%{name}
+%endif
+%dir /run/%{name}
+%{_tmpfilesdir}/%{name}.conf
+%doc README.md COPYING
+
+%if 0%{?fedora} || 0%{?rhel} > 7
+%files devel
+%{_includedir}/criu
+%{_libdir}/*.so
+%{_libdir}/pkgconfig/*.pc
+%endif
+
+%files -n %{py_prefix}-%{name}
+%if 0%{?rhel} && 0%{?rhel} <= 7
+%{python2_sitelib}/pycriu/*
+%{python2_sitelib}/*egg-info
+%else
+%{python3_sitelib}/pycriu/*
+%{python3_sitelib}/*egg-info
+%endif
+
+%files -n crit
+%{_bindir}/crit
+%doc %{_mandir}/man1/crit.1*
+
+
+%changelog
+* Tue Dec 11 2018 Adrian Reber <adrian@lisas.de> - 3.10-7
+- Fix 'criu check --feature link_nsid' with more than 10 interfaces (#1652442)
+
+* Tue Dec 11 2018 Adrian Reber <adrian@lisas.de> - 3.10-6
+- Make sure no iptables rules are left after restore (#1652471)
+
+* Tue Oct 30 2018 Adrian Reber <adrian@lisas.de> - 3.10-5
+- Added Recommends: tar
+  It is necessary when checkpointing containers with a tmpfs
+
+* Mon Jul 16 2018 Adrian Reber <adrian@lisas.de> - 3.10-4
+- Add patch to fix errors with read-only runc
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.10-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Jul 11 2018 Adrian Reber <adrian@lisas.de> - 3.10-2
+- Disable annobin as it seems to break CRIU
+
+* Tue Jul 10 2018 Adrian Reber <adrian@lisas.de> - 3.10-1
+- Update to 3.10 (#1599710)
+- Switch to python3
+
+* Wed Jun 06 2018 Adrian Reber <adrian@lisas.de> - 3.9-2
+- Simplify ExclusiveArch now that there is no more F26
+
+* Fri Jun 01 2018 Adrian Reber <adrian@lisas.de> - 3.9-1
+- Update to 3.9
+
+* Tue Apr 03 2018 Adrian Reber <adrian@lisas.de> - 3.8.1-1
+- Update to 3.8.1
+
+* Thu Mar 22 2018 Adrian Reber <adrian@lisas.de> - 3.8-2
+- Bump release for COPR
+
+* Wed Mar 14 2018 Adrian Reber <adrian@lisas.de> - 3.8-1
+- Update to 3.8
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.7-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Sat Feb 03 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 3.7-4
+- Switch to %%ldconfig_scriptlets
+
+* Fri Jan 12 2018 Adrian Reber <adrian@lisas.de> - 3.7-3
+- Fix python/python2 dependencies accross all branches
+
+* Wed Jan 03 2018 Merlin Mathesius <mmathesi@redhat.com> - 3.7-2
+- Cleanup spec file conditionals
+
+* Sat Dec 30 2017 Adrian Reber <adrian@lisas.de> - 3.7-1
+- Update to 3.7
+
+* Fri Dec 15 2017 Iryna Shcherbina <ishcherb@redhat.com> - 3.6-2
+- Update Python 2 dependency declarations to new packaging standards
+  (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)
+
+* Thu Oct 26 2017 Adrian Reber <adrian@lisas.de> - 3.6-1
+- Update to 3.6
+
+* Wed Oct 18 2017 Adrian Reber <adrian@lisas.de> - 3.5-5
+- Added patch to fix build on Fedora rawhide aarch64
+
+* Tue Oct 10 2017 Adrian Reber <areber@redhat.com> - 3.5-4
+- Upgrade imported manpages to 3.5
+
+* Mon Oct 09 2017 Adrian Reber <areber@redhat.com> - 3.5-3
+- Fix ExclusiveArch on RHEL
+
+* Mon Oct 02 2017 Adrian Reber <adrian@lisas.de> - 3.5-2
+- Merge RHEL and Fedora spec file
+
+* Thu Sep 28 2017 Adrian Reber <adrian@lisas.de> - 3.5-1
+- Update to 3.5 (#1496614)
+
+* Sun Aug 27 2017 Adrian Reber <adrian@lisas.de> - 3.4-1
+- Update to 3.4 (#1483774)
+- Removed upstreamed patches
+- Added s390x (#1475719)
+
+* Sat Aug 19 2017 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.3-5
+- Python 2 binary package renamed to python2-criu
+  See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3
+
+* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Thu Jul 20 2017 Adrian Reber <adrian@lisas.de> - 3.3-2
+- Added patches to handle changes in glibc
+
+* Wed Jul 19 2017 Adrian Reber <adrian@lisas.de> - 3.3-1
+- Update to 3.3
+
+* Fri Jun 30 2017 Adrian Reber <adrian@lisas.de> - 3.2.1-2
+- Added patches to handle unified hierarchy and new glibc
+
+* Wed Jun 28 2017 Adrian Reber <adrian@lisas.de> - 3.2.1-1
+- Update to 3.2.1-1
+
+* Tue Jun 13 2017 Orion Poplawski <orion@cora.nwra.com> - 3.1-2
+- Rebuild for protobuf 3.3.1
+
+* Mon May 22 2017 Adrian Reber <adrian@lisas.de> - 3.1-1
+- Update to 3.1
+
+* Tue Apr 25 2017 Adrian Reber <adrian@lisas.de> - 3.0-1
+- Update to 3.0
+
+* Thu Mar 09 2017 Adrian Reber <adrian@lisas.de> - 2.12-1
+- Update to 2.12
+
+* Fri Feb 17 2017 Adrian Reber <adrian@lisas.de> - 2.11.1-1
+- Update to 2.11.1
+
+* Thu Feb 16 2017 Adrian Reber <adrian@lisas.de> - 2.11-1
+- Update to 2.11
+
+* Mon Feb 13 2017 Adrian Reber <adrian@lisas.de> - 2.10-4
+- Added patch to fix build on ppc64le
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.10-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Mon Jan 23 2017 Orion Poplawski <orion@cora.nwra.com> - 2.10-2
+- Rebuild for protobuf 3.2.0
+
+* Mon Jan 16 2017 Adrian Reber <adrian@lisas.de> - 2.10-1
+- Update to 2.10
+
+* Mon Dec 12 2016 Adrian Reber <adrian@lisas.de> - 2.9-1
+- Update to 2.9
+- Added crit manpage to crit subpackage
+
+* Sat Nov 19 2016 Orion Poplawski <orion@cora.nwra.com> - 2.8-2
+- Rebuild for protobuf 3.1.0
+
+* Tue Nov 15 2016 Adrian Reber <adrian@lisas.de> - 2.8-1
+- Update to 2.8
+- Dropped 'mount_resolve_path()' patch
+
+* Wed Oct 19 2016 Adrian Reber <adrian@lisas.de> - 2.7-2
+- Added upstream patch to fix #1381351
+  ("criu: mount_resolve_path(): criu killed by SIGSEGV")
+
+* Wed Oct 19 2016 Adrian Reber <adrian@lisas.de> - 2.7-1
+- Update to 2.7
+
+* Tue Sep 13 2016 Adrian Reber <adrian@lisas.de> - 2.6-1
+- Update to 2.6
+
+* Tue Aug 30 2016 Adrian Reber <adrian@lisas.de> - 2.5-1
+- Update to 2.5
+
+* Tue Jul 19 2016 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 2.4-2
+- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages
+
+* Tue Jul 12 2016 Adrian Reber <adrian@lisas.de> - 2.4-1
+- Update to 2.4
+
+* Tue Jun 14 2016 Adrian Reber <areber@redhat.com> - 2.3-1
+- Update to 2.3
+- Copy man-page from Fedora 24 for RHEL
+
+* Mon May 23 2016 Adrian Reber <adrian@lisas.de> - 2.2-1
+- Update to 2.2
+
+* Tue Apr 12 2016 Adrian Reber <adrian@lisas.de> - 2.1-2
+- Remove crtools symbolic link
+
+* Mon Apr 11 2016 Adrian Reber <adrian@lisas.de> - 2.1-1
+- Update to 2.1
+
+* Wed Apr 06 2016 Adrian Reber <areber@redhat.com> - 2.0-2
+- Merge changes from Fedora
+
+* Thu Mar 10 2016 Andrey Vagin <avagin@openvz.org> - 2.0-1
+- Update to 2.0
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Mon Dec 07 2015 Adrian Reber <adrian@lisas.de> - 1.8-1
+- Update to 1.8
+
+* Mon Nov 02 2015 Adrian Reber <adrian@lisas.de> - 1.7.2-1
+- Update to 1.7.2
+
+* Mon Sep 7 2015 Andrey Vagin <avagin@openvz.org> - 1.7-1
+- Update to 1.7
+
+* Thu Sep 3 2015 Andrey Vagin <avagin@openvz.org> - 1.6.1-3
+- Build only for power64le
+
+* Thu Sep 3 2015 Andrey Vagin <avagin@openvz.org> - 1.6.1-2
+- Build for aarch64 and power64
+
+* Thu Aug 13 2015 Adrian Reber <adrian@lisas.de> - 1.6.1-1
+- Update to 1.6.1
+- Merge changes for RHEL packaging
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Tue Jun 09 2015 Adrian Reber <areber@redhat.com> - 1.6-1.1
+- adapt to RHEL7
+
+* Mon Jun 01 2015 Andrew Vagin <avagin@openvz.org> - 1.6-1
+- Update to 1.6
+
+* Thu Apr 30 2015 Andrew Vagin <avagin@openvz.org> - 1.5.2-2
+- Require protobuf-python and python-ipaddr for python-criu
+
+* Tue Apr 28 2015 Andrew Vagin <avagin@openvz.org> - 1.5.2
+- Update to 1.5.2
+
+* Sun Apr 19 2015 Nikita Spiridonov <nspiridonov@odin.com> - 1.5.1-2
+- Create python-criu and crit subpackages
+
+* Tue Mar 31 2015 Andrew Vagin <avagin@openvz.org> - 1.5.1
+- Update to 1.5.1
+
+* Sat Dec 06 2014 Adrian Reber <adrian@lisas.de> - 1.4-1
+- Update to 1.4
+
+* Tue Sep 23 2014 Adrian Reber <adrian@lisas.de> - 1.3.1-1
+- Update to 1.3.1 (#1142896)
+
+* Tue Sep 02 2014 Adrian Reber <adrian@lisas.de> - 1.3-1
+- Update to 1.3
+- Dropped all upstreamed patches
+- included pkgconfig file in -devel
+
+* Sat Aug 16 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild
+
+* Thu Aug 07 2014 Andrew Vagin <avagin@openvz.org> - 1.2-4
+- Include inttypes.h for PRI helpers
+
+* Thu Aug 07 2014 Andrew Vagin <avagin@openvz.org> - 1.2-3
+- Rebuilt for https://bugzilla.redhat.com/show_bug.cgi?id=1126751
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Fri Feb 28 2014 Adrian Reber <adrian@lisas.de> - 1.2-1
+- Update to 1.2
+- Dropped all upstreamed patches
+
+* Tue Feb 04 2014 Adrian Reber <adrian@lisas.de> - 1.1-4
+- Create -devel subpackage
+
+* Wed Dec 11 2013 Andrew Vagin <avagin@openvz.org> - 1.0-3
+- Fix the epoch of crtools
+
+* Tue Dec 10 2013 Andrew Vagin <avagin@openvz.org> - 1.0-2
+- Rename crtools to criu #1034677
+
+* Wed Nov 27 2013 Andrew Vagin <avagin@openvz.org> - 1.0-1
+- Update to 1.0
+
+* Thu Oct 24 2013 Andrew Vagin <avagin@openvz.org> - 0.8-1
+- Update to 0.8
+
+* Tue Sep 10 2013 Andrew Vagin <avagin@openvz.org> - 0.7-1
+- Update to 0.7
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Wed Jul 24 2013 Andrew Vagin <avagin@openvz.org> - 0.6-3
+- Delete all kind of -fstack-protector gcc options
+
+* Wed Jul 24 2013 Andrew Vagin <avagin@openvz.org> - 0.6-3
+- Added arm macro to ExclusiveArch
+
+* Wed Jul 03 2013 Andrew Vagin <avagin@openvz.org> - 0.6-2
+- fix building on ARM
+- fix null pointer dereference
+
+* Tue Jul 02 2013 Adrian Reber <adrian@lisas.de> - 0.6-1
+- updated to 0.6
+- upstream moved binaries to sbin
+- using upstream's make install
+
+* Tue May 14 2013 Adrian Reber <adrian@lisas.de> - 0.5-1
+- updated to 0.5
+
+* Fri Feb 22 2013 Adrian Reber <adrian@lisas.de> - 0.4-1
+- updated to 0.4
+
+* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Tue Jan 22 2013 Adrian Reber <adrian@lisas.de> - 0.3-3
+- added ExclusiveArch blocker bug
+
+* Fri Jan 18 2013 Adrian Reber <adrian@lisas.de> - 0.3-2
+- improved Summary and Description
+
+* Mon Jan 14 2013 Adrian Reber <adrian@lisas.de> - 0.3-1
+- updated to 0.3
+- fix building Documentation/
+
+* Tue Aug 21 2012 Adrian Reber <adrian@lisas.de> - 0.2-2
+- remove macros like %%{__mkdir_p} and %%{__install}
+- add comment why it is only x86_64
+
+* Tue Aug 21 2012 Adrian Reber <adrian@lisas.de> - 0.2-1
+- initial release