diff --git a/security-tool.sh b/security-tool.sh
index b745ba7..c6bc4e7 100644
--- a/security-tool.sh
+++ b/security-tool.sh
@@ -175,7 +175,7 @@ function fn_exit()
                 if [ $s -eq 0 ]; then
                         local new_initrd=$WORKD`basename $GZ_F`".secure"
                         pushd $ROOTFS
-                        tar -cf "$ROOTFS/$TMPTARGET" -- *
+                        tar -cf -- "$ROOTFS/$TMPTARGET" *
                         gzip <"$ROOTFS/$TMPTARGET" > $new_initrd
                         fn_info "hardened initrd is $new_initrd"
                         popd
diff --git a/security-tool.spec b/security-tool.spec
index 2ddf7e6..c98ab04 100644
--- a/security-tool.spec
+++ b/security-tool.spec
@@ -1,7 +1,7 @@
 Summary: openEuler Security Tool
 Name   : security-tool
 Version: 2.0
-Release: 1.46
+Release: 1.47
 Source0: %{name}-%{version}.tar.bz2
 Source1: security
 Source2: security.conf
@@ -124,6 +124,9 @@ fi
 %attr(0500,root,root) %{_sbindir}/security-tool.sh
 
 %changelog
+* Fri May 29 2020 openEuler Buildteam <buildteam@openEuler.org> - 2.0-1.47
+- Move -- befora path
+
 * Fri May 29 2020 openEuler Buildteam <buildteam@openEuler.org> - 2.0-1.46
 - Do not set umask to 077 any more