diff --git a/dnsmasq.changes b/dnsmasq.changes
index 388e321..76677db 100644
--- a/dnsmasq.changes
+++ b/dnsmasq.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Mon Apr 20 12:14:54 UTC 2015 - abergmann@suse.com
+
+- Move trust-anchors.conf into /etc/dnsmasq.d to be AppArmor conform.
+  (bnc#908137)
+
 -------------------------------------------------------------------
 Tue Jan  6 09:58:25 UTC 2015 - jslaby@suse.com
 
diff --git a/dnsmasq.spec b/dnsmasq.spec
index 2160b2a..39fe938 100644
--- a/dnsmasq.spec
+++ b/dnsmasq.spec
@@ -83,6 +83,10 @@ sed -i -e 's|CACHESIZ 150|CACHESIZ 2000|;
 	   s|CHGRP "dip"|CHGRP "nogroup"|' \
 	src/config.h
 
+# Fix trust-anchor.conf location
+sed -i -e '/trust-anchors.conf/c\#conf-file=/etc/dnsmasq.d/trust-anchors.conf' \
+	dnsmasq.conf.example
+
 %build
 echo "#define HAVE_DBUS" >> src/config.h
 echo "#define HAVE_CONNTRACK" >> src/config.h
@@ -130,7 +134,8 @@ install -m 644 dbus/dnsmasq.conf ${RPM_BUILD_ROOT}/etc/dbus-1/system.d/dnsmasq.c
 install -D -m 0644 %SOURCE2 %{buildroot}%{_unitdir}/dnsmasq.service
 install -d -m 0750 ${RPM_BUILD_ROOT}/srv/tftpboot
 ln -sf %{_sbindir}/service $RPM_BUILD_ROOT/usr/sbin/rcdnsmasq
-install -D -m 0644 trust-anchors.conf %{buildroot}%{_datadir}/%{name}/trust-anchors.conf
+install -d -m 755 ${RPM_BUILD_ROOT}/%{_sysconfdir}/dnsmasq.d
+install -m 644 trust-anchors.conf ${RPM_BUILD_ROOT}/%{_sysconfdir}/dnsmasq.d/trust-anchors.conf
 
 # utils subpackage
 mkdir -p $RPM_BUILD_ROOT%{_bindir} $RPM_BUILD_ROOT%{_mandir}/man1
@@ -160,8 +165,8 @@ rm -rf contrib/MacOSX-launchd
 %{_mandir}/man8/dnsmasq.8.gz
 %config(noreplace) /etc/dbus-1/system.d/dnsmasq.conf
 %{_unitdir}/dnsmasq.service
-%dir %{_datadir}/%{name}
-%{_datadir}/%{name}/trust-anchors.conf
+%dir %{_sysconfdir}/dnsmasq.d
+%config(noreplace) %{_sysconfdir}/dnsmasq.d/trust-anchors.conf
 
 %dir %attr(0750,tftp,tftp) /srv/tftpboot