diff --git a/pppoe-server.service b/pppoe-server.service
index b1da382..7011fb8 100644
--- a/pppoe-server.service
+++ b/pppoe-server.service
@@ -3,6 +3,7 @@ Description=PPPoE Server.
 After=syslog.target
 
 [Service]
+Group=dialout
 ExecStart=/usr/sbin/pppoe-server
 
 [Install]
diff --git a/pppoe.service b/pppoe.service
index eb14ce1..033f389 100644
--- a/pppoe.service
+++ b/pppoe.service
@@ -4,6 +4,7 @@ After=network.target
 Wants=network.target
 
 [Service]
+Group=dialout
 Type=oneshot
 RemainAfterExit=true
 ExecStart=/usr/sbin/pppoe-start
diff --git a/rp-pppoe.changes b/rp-pppoe.changes
index dfff1d3..c6755db 100644
--- a/rp-pppoe.changes
+++ b/rp-pppoe.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Nov 23 14:06:28 UTC 2017 - ilya@ilya.pp.ua
+
+- Add Requires/Requires(pre) group(dialout) (boo#1067511).
+- Add %verify_permissions script for pppoe-wrapper.
+
 -------------------------------------------------------------------
 Thu Nov  9 12:53:45 UTC 2017 - ilya@ilya.pp.ua
 
diff --git a/rp-pppoe.spec b/rp-pppoe.spec
index 81f7498..0a4445a 100644
--- a/rp-pppoe.spec
+++ b/rp-pppoe.spec
@@ -16,6 +16,7 @@
 #
 
 %define _name pppoe
+%define _group dialout
 Name:           rp-%{_name}
 Version:        3.12
 Release:        0
@@ -43,6 +44,13 @@ BuildRequires:  ppp
 BuildRequires:  systemd
 Requires:       net-tools
 Requires:       ppp
+Requires(post): permissions
+%if 0%{?suse_version} >= 1330
+Requires:       group(%{_group})
+Requires(pre):  group(%{_group})
+%else
+Requires(pre):  shadow
+%endif
 
 %description
 %{name} is a user-space redirector which permits the use of PPPoE
@@ -90,6 +98,9 @@ mv %{buildroot}%{_sysconfdir}/ppp/plugins/README %{buildroot}%{_defaultdocdir}/%
 rm -rf %{buildroot}%{_sysconfdir}/ppp/plugins
 
 %pre
+%if 0%{?suse_version} < 1330
+getent group %{_group} >/dev/null || %{_sbindir}/groupadd -r %{_group}
+%endif
 %service_add_pre %{_name}.service
 %service_add_pre %{_name}-server.service
 
@@ -100,11 +111,15 @@ rm -rf %{buildroot}%{_sysconfdir}/ppp/plugins
 %post
 %service_add_post %{_name}.service
 %service_add_post %{_name}-server.service
+%set_permissions %{_sbindir}/%{_name}-wrapper
 
 %postun
 %service_del_postun %{_name}.service
 %service_del_postun %{_name}-server.service
 
+%verifyscript
+%verify_permissions -e %{_sbindir}/%{_name}-wrapper
+
 %files
 %dir %{_defaultdocdir}/%{name}
 %doc %{_defaultdocdir}/%{name}/*
@@ -152,5 +167,6 @@ rm -rf %{buildroot}%{_sysconfdir}/ppp/plugins
 %{_datarootdir}/tk%{_name}/props-options.png
 %{_datarootdir}/tk%{_name}/en.msg
 %{_datarootdir}/tk%{_name}/ja.msg
+%verify(not mode caps) %attr(4750,root,dialout) %{_sbindir}/%{_name}-wrapper
 
 %changelog