diff --git a/openssh-7.7p1-sftp_force_permissions.patch b/openssh-7.7p1-sftp_force_permissions.patch
index 31f2113..9f313c9 100644
--- a/openssh-7.7p1-sftp_force_permissions.patch
+++ b/openssh-7.7p1-sftp_force_permissions.patch
@@ -1,123 +1,100 @@
-# HG changeset patch
-# Parent  37bba3ff816d9ab93ddcf23389a4eb29d7716006
-additional option for sftp-server to force file mode for new files
-FATE#312774
-http://lists.mindrot.org/pipermail/openssh-unix-dev/2010-November/029044.html
-http://marc.info/?l=openssh-unix-dev&m=128896838930893
-
-diff --git a/openssh-7.7p1/sftp-server.8 b/openssh-7.7p1/sftp-server.8
---- openssh-7.7p1/sftp-server.8
-+++ openssh-7.7p1/sftp-server.8
-@@ -33,16 +33,17 @@
- .Bk -words
- .Op Fl ehR
- .Op Fl d Ar start_directory
- .Op Fl f Ar log_facility
- .Op Fl l Ar log_level
+--- original/sftp-server.8	2016-12-19 04:59:41.000000000 +0000
++++ original/sftp-server.8	2017-11-23 08:47:01.267239186 +0000
+@@ -38,6 +38,7 @@ 
  .Op Fl P Ar blacklisted_requests
  .Op Fl p Ar whitelisted_requests
  .Op Fl u Ar umask
-+.Op Fl m Ar force_file_permissions
++.Op Fl m Ar force_file_dir_perms
  .Ek
  .Nm
  .Fl Q Ar protocol_feature
- .Sh DESCRIPTION
- .Nm
- is a program that speaks the server side of SFTP protocol
- to stdout and expects client requests from stdin.
- .Nm
-@@ -133,16 +134,20 @@ Places this instance of
- into a read-only mode.
- Attempts to open files for writing, as well as other operations that change
- the state of the filesystem, will be denied.
- .It Fl u Ar umask
- Sets an explicit
+@@ -138,6 +139,10 @@ 
  .Xr umask 2
  to be applied to newly-created files and directories, instead of the
  user's default mask.
-+.It Fl m Ar force_file_permissions
-+Sets explicit file permissions to be applied to newly-created files instead
-+of the default or client requested mode.  Numeric values include:
++.It Fl m Ar force_file_dir_perms
++Sets explicit permissions to be applied to newly-created files and directories
++instead of the default or client requested mode.  Numeric values include:
 +777, 755, 750, 666, 644, 640, etc.  Option -u is ineffective if -m is set.
  .El
  .Pp
  On some systems,
- .Nm
- must be able to access
- .Pa /dev/log
- for logging to work, and use of
- .Nm
-diff --git a/openssh-7.7p1/sftp-server.c b/openssh-7.7p1/sftp-server.c
---- openssh-7.7p1/sftp-server.c
-+++ openssh-7.7p1/sftp-server.c
-@@ -71,16 +71,20 @@ static u_int version;
- static int init_done;
+--- original/sftp-server.c	2016-12-19 04:59:41.000000000 +0000
++++ original/sftp-server.c	2017-11-23 13:07:08.481765581 +0000
+@@ -65,6 +65,10 @@ 
+ /* Version of client */
+ static u_int version;
  
- /* Disable writes */
- static int readonly;
- 
- /* Requests that are allowed/denied */
- static char *request_whitelist, *request_blacklist;
- 
-+/* Force file permissions */
++/* Force file and directory permissions */
 +int permforce = 0;
 +long permforcemode;
 +
- /* portable attributes, etc. */
- typedef struct Stat Stat;
+ /* SSH2_FXP_INIT received */
+ static int init_done;
  
- struct Stat {
+@@ -679,6 +683,7 @@ 
+ 	Attrib a;
  	char *name;
- 	char *long_name;
- 	Attrib attrib;
- };
-@@ -685,16 +689,20 @@ process_open(u_int32_t id)
+ 	int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
++	mode_t old_umask = 0;
+ 
  	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
  	    (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
- 	    (r = decode_attrib(iqueue, &a)) != 0)
- 		fatal("%s: buffer error: %s", __func__, ssh_err(r));
- 
+@@ -688,6 +693,10 @@ 
  	debug3("request %u: open flags %d", id, pflags);
  	flags = flags_from_portable(pflags);
  	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
-+	if (permforce == 1) {
++	if (permforce == 1) {   /* Force perm if -m is set */
 +		mode = permforcemode;
-+		(void)umask(0); /* so umask does not interfere */
++		old_umask = umask(0); /* so umask does not interfere */
 +	}
  	logit("open \"%s\" flags %s mode 0%o",
  	    name, string_from_portable(pflags), mode);
  	if (readonly &&
- 	    ((flags & O_ACCMODE) != O_RDONLY ||
- 	    (flags & (O_CREAT|O_TRUNC)) != 0)) {
- 		verbose("Refusing open request in read-only mode");
- 		status = SSH2_FX_PERMISSION_DENIED;
- 	} else {
-@@ -1487,17 +1495,18 @@ sftp_server_cleanup_exit(int i)
- static void
- sftp_server_usage(void)
- {
- 	extern char *__progname;
+@@ -709,6 +718,8 @@ 
+ 			}
+ 		}
+ 	}
++	if (permforce == 1)
++		(void) umask(old_umask); /* restore umask to something sane */
+ 	if (status != SSH2_FX_OK)
+ 		send_status(id, status);
+ 	free(name);
+@@ -1110,6 +1121,7 @@ 
+ 	Attrib a;
+ 	char *name;
+ 	int r, mode, status = SSH2_FX_FAILURE;
++	mode_t old_umask = 0;
  
+ 	if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
+ 	    (r = decode_attrib(iqueue, &a)) != 0)
+@@ -1117,9 +1129,16 @@ 
+ 
+ 	mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
+ 	    a.perm & 07777 : 0777;
++	if (permforce == 1) {   /* Force perm if -m is set */
++		mode = permforcemode;
++		old_umask = umask(0); /* so umask does not interfere */
++	}
++
+ 	debug3("request %u: mkdir", id);
+ 	logit("mkdir name \"%s\" mode 0%o", name, mode);
+ 	r = mkdir(name, mode);
++        if (permforce == 1)
++                (void) umask(old_umask); /* restore umask to something sane */
+ 	status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
+ 	send_status(id, status);
+ 	free(name);
+@@ -1490,7 +1509,7 @@ 
  	fprintf(stderr,
  	    "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
  	    "[-l log_level]\n\t[-P blacklisted_requests] "
 -	    "[-p whitelisted_requests] [-u umask]\n"
-+	    "[-p whitelisted_requests] [-u umask]\n\t"
-+	    "[-m force_file_permissions]\n"
++	    "[-p whitelisted_requests] [-u umask] [-m force_file_dir_perms]\n"
  	    "       %s -Q protocol_feature\n",
  	    __progname, __progname);
  	exit(1);
- }
- 
- int
- sftp_server_main(int argc, char **argv, struct passwd *user_pw)
- {
-@@ -1516,17 +1525,17 @@ sftp_server_main(int argc, char **argv, 
- 
- 	ssh_malloc_init();	/* must be called before any mallocs */
- 	__progname = ssh_get_progname(argv[0]);
- 	log_init(__progname, log_level, log_facility, log_stderr);
- 
+@@ -1516,7 +1535,7 @@ 
  	pw = pwcopy(user_pw);
  
  	while (!skipargs && (ch = getopt(argc, argv,
@@ -126,32 +103,19 @@ diff --git a/openssh-7.7p1/sftp-server.c b/openssh-7.7p1/sftp-server.c
  		switch (ch) {
  		case 'Q':
  			if (strcasecmp(optarg, "requests") != 0) {
- 				fprintf(stderr, "Invalid query type\n");
- 				exit(1);
- 			}
- 			for (i = 0; handlers[i].handler != NULL; i++)
- 				printf("%s\n", handlers[i].name);
-@@ -1576,16 +1585,23 @@ sftp_server_main(int argc, char **argv, 
- 		case 'u':
- 			errno = 0;
- 			mask = strtol(optarg, &cp, 8);
- 			if (mask < 0 || mask > 0777 || *cp != '\0' ||
- 			    cp == optarg || (mask == 0 && errno != 0))
+@@ -1576,6 +1595,15 @@ 
  				fatal("Invalid umask \"%s\"", optarg);
  			(void)umask((mode_t)mask);
  			break;
 +		case 'm':
++			/* Force permissions on file and directory received via sftp */
 +			permforce = 1;
 +			permforcemode = strtol(optarg, &cp, 8);
-+			if (permforcemode < 0 || permforcemode > 0777 || *cp != '\0' ||
-+				cp == optarg || (permforcemode == 0 && errno != 0))
-+				fatal("Invalid umask \"%s\"", optarg);
++			if (permforcemode < 0 || permforcemode > 0777 ||
++			    *cp != '\0' || (permforcemode == 0 &&
++			    errno != 0))
++				fatal("Invalid file mode \"%s\"", optarg);
 +			break;
  		case 'h':
  		default:
  			sftp_server_usage();
- 		}
- 	}
- 
- 	log_init(__progname, log_level, log_facility, log_stderr);
- 
diff --git a/openssh.changes b/openssh.changes
index 3052e64..8a37f61 100644
--- a/openssh.changes
+++ b/openssh.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Fri Oct 19 13:11:34 UTC 2018 - Tomáš Chvátal <tchvatal@suse.com>
+
+- Update openssh-7.7p1-sftp_force_permissions.patch from the
+  upstream bug, and mention the bug in the spec
+
 -------------------------------------------------------------------
 Fri Oct 19 08:36:52 UTC 2018 - Tomáš Chvátal <tchvatal@suse.com>
 
diff --git a/openssh.spec b/openssh.spec
index ec9bb7e..9a5a614 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -79,6 +79,7 @@ Patch25:        openssh-7.7p1-openssl_1.1.0.patch
 Patch26:        openssh-7.7p1-disable_openssl_abi_check.patch
 Patch27:        openssh-7.7p1-no_fork-no_pid_file.patch
 Patch28:        openssh-7.7p1-host_ident.patch
+# https://bugzilla.mindrot.org/show_bug.cgi?id=1844
 Patch29:        openssh-7.7p1-sftp_force_permissions.patch
 Patch30:        openssh-7.7p1-X_forward_with_disabled_ipv6.patch
 Patch31:        openssh-7.7p1-ldap.patch