diff --git a/0001-Workaround-removal-of-libio.h.patch b/0001-Workaround-removal-of-libio.h.patch
new file mode 100644
index 0000000..933568a
--- /dev/null
+++ b/0001-Workaround-removal-of-libio.h.patch
@@ -0,0 +1,100 @@
+From 397feba12151bec18ab208bd8fe1d9f12b9989d0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Mon, 5 Mar 2018 12:27:52 +0000
+Subject: [PATCH] Workaround removal of libio.h
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ gnulib/lib/fflush.c   | 8 ++++----
+ gnulib/lib/fpurge.c   | 2 +-
+ gnulib/lib/freading.c | 2 +-
+ gnulib/lib/fseeko.c   | 4 ++--
+ 4 files changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/gnulib/lib/fflush.c b/gnulib/lib/fflush.c
+index c52883b..3ebbcae 100644
+--- a/gnulib/lib/fflush.c
++++ b/gnulib/lib/fflush.c
+@@ -32,8 +32,8 @@
+ 
+ #undef fflush
+ 
+-
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#define _IO_IN_BACKUP 0x100
++#if defined _IO_ftrylockfile || __GNU_LIBRARY__ /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+ /* Clear the stream's ungetc buffer, preserving the value of ftello (fp).  */
+ static void
+@@ -72,7 +72,7 @@ clear_ungetc_buffer (FILE *fp)
+ 
+ #endif
+ 
+-#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
++#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ /* GNU libc, BeOS, Haiku, Linux libc5 */)
+ 
+ # if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT
+ /* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
+@@ -148,7 +148,7 @@ rpl_fflush (FILE *stream)
+   if (stream == NULL || ! freading (stream))
+     return fflush (stream);
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_ftrylockfile || __GNU_LIBRARY__ /* GNU libc, BeOS, Haiku, Linux libc5 */
+ 
+   clear_ungetc_buffer_preserving_position (stream);
+ 
+diff --git a/gnulib/lib/fpurge.c b/gnulib/lib/fpurge.c
+index b236871..ea8f7f5 100644
+--- a/gnulib/lib/fpurge.c
++++ b/gnulib/lib/fpurge.c
+@@ -62,7 +62,7 @@ fpurge (FILE *fp)
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++# if defined _IO_ftrylockfile || __GNU_LIBRARY__ /* GNU libc, BeOS, Haiku, Linux libc5 */
+   fp->_IO_read_end = fp->_IO_read_ptr;
+   fp->_IO_write_ptr = fp->_IO_write_base;
+   /* Avoid memory leak when there is an active ungetc buffer.  */
+diff --git a/gnulib/lib/freading.c b/gnulib/lib/freading.c
+index 67a884d..fffda1e 100644
+--- a/gnulib/lib/freading.c
++++ b/gnulib/lib/freading.c
+@@ -31,7 +31,7 @@ freading (FILE *fp)
+   /* Most systems provide FILE as a struct and the necessary bitmask in
+      <stdio.h>, because they need it for implementing getc() and putc() as
+      fast macros.  */
+-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++# if defined _IO_ftrylockfile || __GNU_LIBRARY__ /* GNU libc, BeOS, Haiku, Linux libc5 */
+   return ((fp->_flags & _IO_NO_WRITES) != 0
+           || ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0
+               && fp->_IO_read_base != NULL));
+diff --git a/gnulib/lib/fseeko.c b/gnulib/lib/fseeko.c
+index ae9b100..82460e5 100644
+--- a/gnulib/lib/fseeko.c
++++ b/gnulib/lib/fseeko.c
+@@ -47,7 +47,7 @@ fseeko (FILE *fp, off_t offset, int whence)
+ #endif
+ 
+   /* These tests are based on fpurge.c.  */
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_ftrylockfile || __GNU_LIBRARY__ /* GNU libc, BeOS, Haiku, Linux libc5 */
+   if (fp->_IO_read_end == fp->_IO_read_ptr
+       && fp->_IO_write_ptr == fp->_IO_write_base
+       && fp->_IO_save_base == NULL)
+@@ -123,7 +123,7 @@ fseeko (FILE *fp, off_t offset, int whence)
+           return -1;
+         }
+ 
+-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
++#if defined _IO_ftrylockfile || __GNU_LIBRARY__ /* GNU libc, BeOS, Haiku, Linux libc5 */
+       fp->_flags &= ~_IO_EOF_SEEN;
+       fp->_offset = pos;
+ #elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
+-- 
+2.14.3
+
diff --git a/0001-tests-force-use-of-NORMAL-TLS-priority-in-test-suite.patch b/0001-tests-force-use-of-NORMAL-TLS-priority-in-test-suite.patch
new file mode 100644
index 0000000..c0d81b8
--- /dev/null
+++ b/0001-tests-force-use-of-NORMAL-TLS-priority-in-test-suite.patch
@@ -0,0 +1,69 @@
+From ec92abee2851344e4e8c108a26b5cec594561ff4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
+Date: Mon, 5 Mar 2018 12:46:16 +0000
+Subject: [PATCH] tests: force use of "NORMAL" TLS priority in test suite
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When generating certificates we rely on GNUTLS' built-in default setup
+for the ciphers used in the certs. We then currently run with the distro
+specific TLS priority setup which can be much stronger, to the extent
+that the certificates we generate are considered untrustworthy. We don't
+care about the quality of the ciphers we use in the test suite, so just
+force the priority to "NORMAL" which should ensure our certs are
+accepted by GNUTLS.
+
+Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
+---
+ tests/virnettlscontexttest.c | 4 ++--
+ tests/virnettlssessiontest.c | 4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c
+index 089c10e964..86647f3014 100644
+--- a/tests/virnettlscontexttest.c
++++ b/tests/virnettlscontexttest.c
+@@ -72,7 +72,7 @@ static int testTLSContextInit(const void *opaque)
+                                          data->crt,
+                                          KEYFILE,
+                                          NULL,
+-                                         NULL,
++                                         "NORMAL",
+                                          true,
+                                          true);
+     } else {
+@@ -80,7 +80,7 @@ static int testTLSContextInit(const void *opaque)
+                                          NULL,
+                                          data->crt,
+                                          KEYFILE,
+-                                         NULL,
++                                         "NORMAL",
+                                          true,
+                                          true);
+     }
+diff --git a/tests/virnettlssessiontest.c b/tests/virnettlssessiontest.c
+index 6d639e5b16..7e85607181 100644
+--- a/tests/virnettlssessiontest.c
++++ b/tests/virnettlssessiontest.c
+@@ -113,7 +113,7 @@ static int testTLSSessionInit(const void *opaque)
+                                            data->servercrt,
+                                            KEYFILE,
+                                            data->wildcards,
+-                                           NULL,
++                                           "NORMAL",
+                                            false,
+                                            true);
+ 
+@@ -121,7 +121,7 @@ static int testTLSSessionInit(const void *opaque)
+                                            NULL,
+                                            data->clientcrt,
+                                            KEYFILE,
+-                                           NULL,
++                                           "NORMAL",
+                                            false,
+                                            true);
+ 
+-- 
+2.14.3
+
diff --git a/libvirt.spec b/libvirt.spec
index cbc882b..97389b0 100644
--- a/libvirt.spec
+++ b/libvirt.spec
@@ -6,11 +6,6 @@
 %define min_rhel 6
 %define min_fedora 26
 
-# Fedora >= 28 default RPM linker flags set  "-z defs" to refuse
-# to link when there are undefined symbols. This breaks all of our
-# dlopen()able plugins, so we must turn it off.
-%undefine _strict_symbol_defs_build
-
 %if (0%{?fedora} && 0%{?fedora} >= %{min_fedora}) || (0%{?rhel} && 0%{?rhel} >= %{min_rhel})
     %define supported_platform 1
 %else
@@ -78,7 +73,7 @@
 %define with_numactl          0%{!?_without_numactl:1}
 
 # F25+ has zfs-fuse
-%if 0%{?fedora} >= 25
+%if 0%{?fedora}
     %define with_storage_zfs      0%{!?_without_storage_zfs:1}
 %else
     %define with_storage_zfs      0
@@ -148,6 +143,10 @@
     %define with_libxl 0
     %define with_hyperv 0
     %define with_vz 0
+
+    %if 0%{?rhel} > 7
+        %define with_lxc 0
+    %endif
 %endif
 
 # Fedora 17 / RHEL-7 are first where we use systemd. Although earlier
@@ -168,7 +167,7 @@
 %endif
 
 # fuse is used to provide virtualized /proc for LXC
-%if 0%{?fedora} || 0%{?rhel} >= 7
+%if %{with_lxc} && 0%{?rhel} != 6
     %define with_fuse      0%{!?_without_fuse:1}
 %endif
 
@@ -238,29 +237,28 @@
     %define enable_werror --disable-werror
 %endif
 
-%if 0%{?fedora} >= 25
+%if 0%{?fedora}
     %define tls_priority "@LIBVIRT,SYSTEM"
 %else
-    %if 0%{?fedora}
-        %define tls_priority "@SYSTEM"
-    %else
-        %define tls_priority "NORMAL"
-    %endif
+    %define tls_priority "NORMAL"
 %endif
 
 
 Summary: Library providing a simple virtualization API
 Name: libvirt
-Version: 4.0.0
-Release: 2%{?dist}%{?extra_release}
+Version: 4.1.0
+Release: 1%{?dist}%{?extra_release}
 License: LGPLv2+
 Group: Development/Libraries
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root
 URL: https://libvirt.org/
 
 %if %(echo %{version} | grep -q "\.0$"; echo $?) == 1
     %define mainturl stable_updates/
 %endif
 Source: https://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.xz
+Patch1: 0001-Workaround-removal-of-libio.h.patch
+Patch2: 0001-tests-force-use-of-NORMAL-TLS-priority-in-test-suite.patch
 
 Requires: libvirt-daemon = %{version}-%{release}
 Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -303,7 +301,7 @@ BuildRequires: libtool
 BuildRequires: /usr/bin/pod2man
 %endif
 BuildRequires: git
-%if 0%{?fedora} >= 27
+%if 0%{?fedora} >= 27 || 0%{?rhel} > 7
 BuildRequires: perl-interpreter
 %else
 BuildRequires: perl
@@ -455,11 +453,7 @@ BuildRequires: numad
 %endif
 
 %if %{with_wireshark}
-    %if 0%{fedora} >= 24
 BuildRequires: wireshark-devel >= 2.1.0
-    %else
-BuildRequires: wireshark-devel >= 1.12.1
-    %endif
 %endif
 
 %if %{with_libssh}
@@ -803,7 +797,7 @@ Requires: gzip
 Requires: bzip2
 Requires: lzop
 Requires: xz
-    %if 0%{?fedora} >= 24
+    %if 0%{?fedora} || 0%{?rhel} > 7
 Requires: systemd-container
     %endif
 
@@ -821,7 +815,7 @@ Group: Development/Libraries
 Requires: libvirt-daemon = %{version}-%{release}
 # There really is a hard cross-driver dependency here
 Requires: libvirt-daemon-driver-network = %{version}-%{release}
-    %if 0%{?fedora} >= 24
+    %if 0%{?fedora} || 0%{?rhel} > 7
 Requires: systemd-container
     %endif
 
@@ -1026,6 +1020,9 @@ Requires: gnutls-utils
 # Needed for probing the power management features of the host.
 Requires: pm-utils
 %endif
+%if %{with_bash_completion}
+Requires: %{name}-bash-completion = %{version}-%{release}
+%endif
 
 %description client
 The client binaries needed to access the virtualization
@@ -1050,10 +1047,22 @@ Summary: Set of tools to control libvirt daemon
 Group: Development/Libraries
 Requires: %{name}-libs = %{version}-%{release}
 Requires: readline
+%if %{with_bash_completion}
+Requires: %{name}-bash-completion = %{version}-%{release}
+%endif
 
 %description admin
 The client side utilities to control the libvirt daemon.
 
+%if %{with_bash_completion}
+%package bash-completion
+Summary: Bash completion script
+Group: Development/Libraries
+
+%description bash-completion
+Bash completion script stub.
+%endif
+
 %if %{with_wireshark}
 %package wireshark
 Summary: Wireshark dissector plugin for libvirt RPC transactions
@@ -1176,8 +1185,10 @@ exit 1
 
 %if %{with_lxc}
     %define arg_lxc --with-lxc
+    %define arg_login_shell --with-login-shell
 %else
     %define arg_lxc --without-lxc
+    %define arg_login_shell --without-login-shell
 %endif
 
 %if %{with_vbox}
@@ -1387,7 +1398,8 @@ rm -f po/stamp-po
            %{?arg_loader_nvram} \
            %{?enable_werror} \
            --enable-expensive-tests \
-           %{arg_init_script}
+           %{arg_init_script} \
+           %{?arg_login_shell}
 make %{?_smp_mflags} V=1
 gzip -9 ChangeLog
 
@@ -1412,13 +1424,7 @@ rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/connection-driver/*.a
 rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/storage-backend/*.la
 rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/storage-backend/*.a
 %if %{with_wireshark}
-    %if 0%{fedora} >= 24
 rm -f $RPM_BUILD_ROOT%{_libdir}/wireshark/plugins/libvirt.la
-    %else
-rm -f $RPM_BUILD_ROOT%{_libdir}/wireshark/plugins/*/libvirt.la
-mv $RPM_BUILD_ROOT%{_libdir}/wireshark/plugins/*/libvirt.so \
-      $RPM_BUILD_ROOT%{_libdir}/wireshark/plugins/libvirt.so
-    %endif
 %endif
 
 install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/lib/libvirt/dnsmasq/
@@ -1483,6 +1489,9 @@ mv $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/libvirt_qemu_probes.stp \
    $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/libvirt_qemu_probes-64.stp
 %endif
 
+%clean
+rm -fr %{buildroot}
+
 %check
 cd tests
 # These tests don't current work in a mock build root
@@ -1511,13 +1520,17 @@ exit 0
 
 %if %{with_systemd}
     %if %{with_systemd_macros}
-        %systemd_post virtlockd.socket virtlogd.socket libvirtd.service
+        %systemd_post virtlockd.socket virtlockd-admin.socket \
+            virtlogd.socket virtlogd-admin.socket \
+            libvirtd.service
     %else
 if [ $1 -eq 1 ] ; then
     # Initial installation
     /bin/systemctl enable \
         virtlockd.socket \
+        virtlockd-admin.socket \
         virtlogd.socket \
+        virtlogd-admin.socket \
         libvirtd.service >/dev/null 2>&1 || :
 fi
     %endif
@@ -1544,21 +1557,27 @@ touch %{_localstatedir}/lib/rpm-state/libvirt/restart || :
 %preun daemon
 %if %{with_systemd}
     %if %{with_systemd_macros}
-        %systemd_preun libvirtd.service virtlogd.socket virtlogd.service virtlockd.socket virtlockd.service
+        %systemd_preun libvirtd.service \
+            virtlogd.socket virtlogd-admin.socket virtlogd.service \
+            virtlockd.socket virtlockd-admin.socket virtlockd.service
     %else
 if [ $1 -eq 0 ] ; then
     # Package removal, not upgrade
     /bin/systemctl --no-reload disable \
         libvirtd.service \
         virtlogd.socket \
+        virtlogd-admin.socket \
         virtlogd.service \
         virtlockd.socket \
+        virtlockd-admin.socket \
         virtlockd.service > /dev/null 2>&1 || :
     /bin/systemctl stop \
         libvirtd.service \
         virtlogd.socket \
+        virtlogd-admin.socket \
         virtlogd.service \
         virtlockd.socket \
+        virtlockd-admin.socket \
         virtlockd.service > /dev/null 2>&1 || :
 fi
     %endif
@@ -1587,15 +1606,6 @@ if [ $1 -ge 1 ]; then
 fi
 %endif
 
-%if %{with_systemd}
-%else
-%triggerpostun daemon -- libvirt-daemon < 1.2.1
-if [ "$1" -ge "1" ]; then
-    /sbin/service virtlockd reload > /dev/null 2>&1 || :
-    /sbin/service virtlogd reload > /dev/null 2>&1 || :
-fi
-%endif
-
 # In upgrade scenario we must explicitly enable virtlockd/virtlogd
 # sockets, if libvirtd is already enabled and start them if
 # libvirtd is running, otherwise you'll get failures to start
@@ -1603,15 +1613,17 @@ fi
 %triggerpostun daemon -- libvirt-daemon < 1.3.0
 if [ $1 -ge 1 ] ; then
 %if %{with_systemd}
-        /bin/systemctl is-enabled libvirtd.service 1>/dev/null 2>&1 &&
-            /bin/systemctl enable virtlogd.socket || :
-        /bin/systemctl is-active libvirtd.service 1>/dev/null 2>&1 &&
-            /bin/systemctl start virtlogd.socket || :
+    /bin/systemctl is-enabled libvirtd.service 1>/dev/null 2>&1 &&
+        /bin/systemctl enable virtlogd.socket virtlogd-admin.socket || :
+    /bin/systemctl is-active libvirtd.service 1>/dev/null 2>&1 &&
+        /bin/systemctl start virtlogd.socket virtlogd-admin.socket || :
 %else
-        /sbin/chkconfig libvirtd 1>/dev/null 2>&1 &&
-            /sbin/chkconfig virtlogd on || :
-        /sbin/service libvirtd status 1>/dev/null 2>&1 &&
-            /sbin/service virtlogd start || :
+    /sbin/chkconfig libvirtd 1>/dev/null 2>&1 &&
+        /sbin/chkconfig virtlogd on || :
+    /sbin/service libvirtd status 1>/dev/null 2>&1 &&
+        /sbin/service virtlogd start || :
+    /sbin/service virtlockd reload > /dev/null 2>&1 || :
+    /sbin/service virtlogd reload > /dev/null 2>&1 || :
 %endif
 fi
 
@@ -1811,14 +1823,15 @@ exit 0
 %{_unitdir}/virt-guest-shutdown.target
 %{_unitdir}/virtlogd.service
 %{_unitdir}/virtlogd.socket
+%{_unitdir}/virtlogd-admin.socket
 %{_unitdir}/virtlockd.service
 %{_unitdir}/virtlockd.socket
+%{_unitdir}/virtlockd-admin.socket
 %else
 %{_sysconfdir}/rc.d/init.d/libvirtd
 %{_sysconfdir}/rc.d/init.d/virtlogd
 %{_sysconfdir}/rc.d/init.d/virtlockd
 %endif
-%doc daemon/libvirtd.upstart
 %config(noreplace) %{_sysconfdir}/sysconfig/libvirtd
 %config(noreplace) %{_sysconfdir}/sysconfig/virtlogd
 %config(noreplace) %{_sysconfdir}/sysconfig/virtlockd
@@ -2065,7 +2078,7 @@ exit 0
 %{_datadir}/systemtap/tapset/libvirt_functions.stp
 
 %if %{with_bash_completion}
-%{_datadir}/bash-completion/completions/vsh
+%{_datadir}/bash-completion/completions/virsh
 %endif
 
 
@@ -2117,7 +2130,14 @@ exit 0
 %files admin
 %{_mandir}/man1/virt-admin.1*
 %{_bindir}/virt-admin
+%if %{with_bash_completion}
+%{_datadir}/bash-completion/completions/virt-admin
+%endif
 
+%if %{with_bash_completion}
+%files bash-completion
+%{_datadir}/bash-completion/completions/vsh
+%endif
 
 %if %{with_wireshark}
 %files wireshark
@@ -2173,6 +2193,9 @@ exit 0
 
 
 %changelog
+* Mon Mar  5 2018 Daniel Berrange <berrange@redhat.com> - 4.1.0-1
+- Rebase to version 4.1.0
+
 * Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 4.0.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild