diff --git a/apparmor.changes b/apparmor.changes
index ef054bd..b2ea16a 100644
--- a/apparmor.changes
+++ b/apparmor.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Tue Oct 17 21:42:38 UTC 2017 - suse-beta@cboltz.de
+
+- add nameservice-libtirpc.diff to fix NIS/YP logins
+
 -------------------------------------------------------------------
 Tue Oct  3 16:28:52 UTC 2017 - rgoldwyn@suse.com
 
diff --git a/apparmor.spec b/apparmor.spec
index b4a88f3..bb3f03a 100644
--- a/apparmor.spec
+++ b/apparmor.spec
@@ -92,6 +92,9 @@ Patch14:        apparmor-fix-podsyntax.patch
 # TODO: replace with proper unix rules when Kernel 4.15 arrives
 Patch15:        profiles-sockets-temporary-fix.patch
 
+# fix NIS/YP logins - libtirpc needs to read /etc/netconfig
+Patch16:        nameservice-libtirpc.diff
+
 PreReq:         sed
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 %define apparmor_bin_prefix /lib/apparmor
@@ -400,6 +403,7 @@ touch libraries/libapparmor/testsuite/test_multi/unconfined-change_hat.err
 %patch13 -p1
 %patch14 -p1
 %patch15 -p1
+%patch16
 
 # search for left-over multiline rules
 test -z "$(grep -r '^\s*\(unix\|dbus\)[^,]\(([^)]*)\)*[^,]*$' profiles/apparmor.d/)"
diff --git a/nameservice-libtirpc.diff b/nameservice-libtirpc.diff
new file mode 100644
index 0000000..b50cf4c
--- /dev/null
+++ b/nameservice-libtirpc.diff
@@ -0,0 +1,13 @@
+=== modified file 'profiles/apparmor.d/abstractions/nameservice'
+--- profiles/apparmor.d/abstractions/nameservice	2017-09-15 20:47:26 +0000
++++ profiles/apparmor.d/abstractions/nameservice	2017-10-17 21:29:36 +0000
+@@ -21,6 +21,9 @@
+   /etc/passwd             r,
+   /etc/protocols          r,
+ 
++  # libtirpc (used for NIS/YP login) needs this
++  /etc/netconfig r,
++
+   # When using libnss-extrausers, the passwd and group files are merged from
+   # an alternate path
+   /var/lib/extrausers/group  r,