I guess this should be changed in the rkhunter.spec? but it probably needs a "if suse_version" or something to work on all versions. Not sure what to use there otherwise I could create a pull request for security:rkhunter