diff --git a/pppoe-server.service b/pppoe-server.service
index b1da382..7011fb8 100644
--- a/pppoe-server.service
+++ b/pppoe-server.service
@@ -3,6 +3,7 @@ Description=PPPoE Server.
 After=syslog.target
 
 [Service]
+Group=dialout
 ExecStart=/usr/sbin/pppoe-server
 
 [Install]
diff --git a/rp-pppoe.changes b/rp-pppoe.changes
index 520a82f..c6755db 100644
--- a/rp-pppoe.changes
+++ b/rp-pppoe.changes
@@ -1,7 +1,8 @@
 -------------------------------------------------------------------
-Thu Nov 23 11:26:52 UTC 2017 - ilya@ilya.pp.ua
+Thu Nov 23 14:06:28 UTC 2017 - ilya@ilya.pp.ua
 
 - Add Requires/Requires(pre) group(dialout) (boo#1067511).
+- Add %verify_permissions script for pppoe-wrapper.
 
 -------------------------------------------------------------------
 Thu Nov  9 12:53:45 UTC 2017 - ilya@ilya.pp.ua
diff --git a/rp-pppoe.spec b/rp-pppoe.spec
index 5eee9df..0a4445a 100644
--- a/rp-pppoe.spec
+++ b/rp-pppoe.spec
@@ -16,6 +16,7 @@
 #
 
 %define _name pppoe
+%define _group dialout
 Name:           rp-%{_name}
 Version:        3.12
 Release:        0
@@ -41,10 +42,15 @@ Patch6:         %{name}-pie.patch
 Patch7:         strip.diff
 BuildRequires:  ppp
 BuildRequires:  systemd
-Requires:       group(dialout)
 Requires:       net-tools
 Requires:       ppp
-Requires(pre):  group(dialout)
+Requires(post): permissions
+%if 0%{?suse_version} >= 1330
+Requires:       group(%{_group})
+Requires(pre):  group(%{_group})
+%else
+Requires(pre):  shadow
+%endif
 
 %description
 %{name} is a user-space redirector which permits the use of PPPoE
@@ -92,6 +98,9 @@ mv %{buildroot}%{_sysconfdir}/ppp/plugins/README %{buildroot}%{_defaultdocdir}/%
 rm -rf %{buildroot}%{_sysconfdir}/ppp/plugins
 
 %pre
+%if 0%{?suse_version} < 1330
+getent group %{_group} >/dev/null || %{_sbindir}/groupadd -r %{_group}
+%endif
 %service_add_pre %{_name}.service
 %service_add_pre %{_name}-server.service
 
@@ -102,11 +111,15 @@ rm -rf %{buildroot}%{_sysconfdir}/ppp/plugins
 %post
 %service_add_post %{_name}.service
 %service_add_post %{_name}-server.service
+%set_permissions %{_sbindir}/%{_name}-wrapper
 
 %postun
 %service_del_postun %{_name}.service
 %service_del_postun %{_name}-server.service
 
+%verifyscript
+%verify_permissions -e %{_sbindir}/%{_name}-wrapper
+
 %files
 %dir %{_defaultdocdir}/%{name}
 %doc %{_defaultdocdir}/%{name}/*
@@ -154,5 +167,6 @@ rm -rf %{buildroot}%{_sysconfdir}/ppp/plugins
 %{_datarootdir}/tk%{_name}/props-options.png
 %{_datarootdir}/tk%{_name}/en.msg
 %{_datarootdir}/tk%{_name}/ja.msg
+%verify(not mode caps) %attr(4750,root,dialout) %{_sbindir}/%{_name}-wrapper
 
 %changelog