rpm --verify fails for (at least some) running services due to the permissions used for their runtime directories.

Taking virtinterfaced for example, if the service is not running everything is fine:

$ systemctl is-active virtinterfaced
inactive
$ sudo rpm -V libvirt-daemon-driver-interface
$

If it's running, however, RPM verification will fail:

$ systemctl is-active virtinterfaced
active
$ sudo rpm -V libvirt-daemon-driver-interface
.M.......  g /run/libvirt/interface

Permissions for the directory are

$ ls -ld /run/libvirt/interface
drwx------. 2 root root 60 Oct  4 17:12 /run/libvirt/interface

which is different from the default of 0755.

The solution should be simply to use the appropriate %attr() macros for these directories.