diff --git a/at-3.1.8-pam-session-as-root.patch b/at-3.1.8-pam-session-as-root.patch
new file mode 100644
index 0000000..acfee70
--- /dev/null
+++ b/at-3.1.8-pam-session-as-root.patch
@@ -0,0 +1,32 @@
+Index: at-3.1.8/atd.c
+===================================================================
+--- at-3.1.8.orig/atd.c	2009-05-14 15:47:05.000000000 +0200
++++ at-3.1.8/atd.c	2009-05-14 15:47:42.000000000 +0200
+@@ -587,11 +587,13 @@ run_file(const char *filename, uid_t uid
+     unlink(filename);
+ 
+ #ifdef  WITH_PAM
++    PRIV_START
+     pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT );
+     pam_close_session(pamh, PAM_SILENT);
+     pam_end(pamh, PAM_ABORT);
+     closelog();
+     openlog("atd", LOG_PID, LOG_ATD);
++    PRIV_END
+ #endif
+ 
+     /* The job is now finished.  We can delete its input file.
+@@ -712,11 +714,13 @@ run_file(const char *filename, uid_t uid
+ 	    waitpid(mail_pid, (int *) NULL, 0);
+ 	  }
+ #ifdef WITH_PAM
++	PRIV_START
+ 	pam_setcred(pamh, PAM_DELETE_CRED | PAM_SILENT );
+ 	pam_close_session(pamh, PAM_SILENT);
+ 	pam_end(pamh, PAM_ABORT);
+ 	closelog();
+ 	openlog("atd", LOG_PID, LOG_ATD);
++	PRIV_END
+ #endif
+     }
+     exit(EXIT_SUCCESS);
diff --git a/at.changes b/at.changes
index e11f4d7..3a8c621 100644
--- a/at.changes
+++ b/at.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu May 14 15:59:43 CEST 2009 - puzel@suse.cz
+
+- added at-3.1.8-pam-session-as-root.patch (bnc#329210, bnc#408986)
+
 -------------------------------------------------------------------
 Mon Mar  2 16:52:17 CET 2009 - sebo@suse.de
 
diff --git a/at.spec b/at.spec
index 57ebd9b..7e5ddd9 100644
--- a/at.spec
+++ b/at.spec
@@ -26,7 +26,7 @@ License:        GPL v2 or later
 Group:          System/Daemons
 AutoReqProv:    on
 Version:        3.1.8
-Release:        1072
+Release:        1073
 Summary:        A Job Manager
 Source:         at_3.1.8-11.tar.gz
 Source1:        atd.init
@@ -47,6 +47,8 @@ Patch11:        %{name}-%{version}-documentation-dir.patch
 Patch12:        %{name}-%{version}-queue-nice-level.patch
 # PATCH-FIX-UPSTREAM cleanup_perm fix permissions for unlink (bnc#478733)
 Patch13:        %{name}-%{version}-cleanup_perm.patch
+# PATCH-FIX-UPSTRAM pam-session-as-root (bnc#408986, bnc#239210)
+Patch14:        %{name}-%{version}-pam-session-as-root.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 PreReq:         /usr/sbin/useradd /usr/sbin/groupadd %fillup_prereq %insserv_prereq
 
@@ -78,6 +80,7 @@ Authors:
 %patch11
 %patch12
 %patch13
+%patch14 -p1
 
 %build
 %{?suse_update_config:%{suse_update_config -f}}
@@ -154,6 +157,8 @@ fi
 /var/adm/fillup-templates/sysconfig.atd
 
 %changelog
+* Thu May 14 2009 puzel@suse.cz
+- added at-3.1.8-pam-session-as-root.patch (bnc#329210, bnc#408986)
 * Mon Mar 02 2009 sebo@suse.de
 - added cleanup_perm.patch to fix permissions for unlink (bnc#478733)
 * Thu Feb 12 2009 mseben@suse.cz
@@ -237,7 +242,7 @@ fi
 - don't activate by default
 * Mon May 19 2003 ro@suse.de
 - fix filelist
-* Mon May 12 2003 ro@suse.de
+* Tue May 13 2003 ro@suse.de
 - use defattr
 * Tue Mar 11 2003 ro@suse.de
 - fix postinstall for updates (appeared in #24653)