diff --git a/.gitignore b/.gitignore
index c6ad332..92ead7f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@
 /ikev1_psk.fax.bz2
 /ikev2.fax.bz2
 /libreswan-3.15.tar.gz
+/libreswan-3.16.tar.gz
diff --git a/libreswan.spec b/libreswan.spec
index 98b9bb4..89d6cc9 100644
--- a/libreswan.spec
+++ b/libreswan.spec
@@ -17,7 +17,7 @@
 
 Name: libreswan
 Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
-Version: 3.15
+Version: 3.16
 Release: %{?prever:0.}1%{?prever:.%{prever}}%{?dist}
 License: GPLv2
 Url: https://www.libreswan.org/
@@ -146,7 +146,7 @@ make \
 FS=$(pwd)
 rm -rf %{buildroot}/usr/share/doc/libreswan
 
-install -d -m 0755 %{buildroot}%{_localstatedir}/run/pluto
+install -d -m 0700 %{buildroot}%{_localstatedir}/run/pluto
 # used when setting --perpeerlog without --perpeerlogbase
 install -d -m 0700 %{buildroot}%{_localstatedir}/log/pluto/peer
 install -d %{buildroot}%{_sbindir}
@@ -210,7 +210,7 @@ OBJ.linux.*/programs/pluto/cavp -v1psk ikev1_psk.fax | \
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/sysctl.d/50-libreswan.conf
 %attr(0700,root,root) %dir %{_localstatedir}/log/pluto
 %attr(0700,root,root) %dir %{_localstatedir}/log/pluto/peer
-%attr(0755,root,root) %dir %{_localstatedir}/run/pluto
+%attr(0700,root,root) %dir %{_localstatedir}/run/pluto
 %attr(0644,root,root) %{_tmpfilesdir}/libreswan.conf
 %attr(0644,root,root) %{_unitdir}/ipsec.service
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
@@ -226,6 +226,9 @@ OBJ.linux.*/programs/pluto/cavp -v1psk ikev1_psk.fax | \
 %endif
 
 %changelog
+* Fri Dec 18 2015 Paul Wouters <pwouters@redhat.com> - 3.16-1
+- Updated to 3.16 (see https://download.libreswan.org/CHANGES)
+
 * Tue Aug 11 2015 Paul Wouters <pwouters@redhat.com> - 3.15-1
 - Updated to 3.15 (see http://download.libreswan.org/CHANGES)
 - Resolves: rhbz#CVE-2015-3240 IKE daemon restart when receiving a bad DH gx
diff --git a/sources b/sources
index 98897db..ef4b03f 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
-719f41125bed347a38298dac232ec477  libreswan-3.15.tar.gz
+22c2d8d5b637e20fe222ebcf99b4a917  libreswan-3.16.tar.gz
 d8b493de7179635a6ed2a4d0e1b35282  ikev1_dsa.fax.bz2
 c4fe7041300e6c21f4561ce818b5002f  ikev1_psk.fax.bz2
 7716c48a1a2b17ba25e89b79889d4004  ikev2.fax.bz2