diff --git a/make-local-unit-tests-work-as-non-root.patch b/make-local-unit-tests-work-as-non-root.patch
new file mode 100644
index 0000000..3a08253
--- /dev/null
+++ b/make-local-unit-tests-work-as-non-root.patch
@@ -0,0 +1,78 @@
+From 14526d3d910260bb9e0b0aebe6e195dc5daf2b7e Mon Sep 17 00:00:00 2001
+From: Aleksa Sarai <asarai@suse.com>
+Date: Tue, 20 Dec 2016 18:20:05 +1100
+Subject: [PATCH] makefile: make local-unit-tests work as root and non-root
+
+This is necessary for %check-style testing inside the openSUSE RPMs, so
+that we can make sure that everything works (or appears to work) when
+releasing packages.
+
+It also increases unit test coverage for the rootless case.
+
+Signed-off-by: Aleksa Sarai <asarai@suse.com>
+---
+ Makefile                      |  2 +-
+ oci/cas/dir_test.go           | 10 ++++++++++
+ oci/layer/tar_extract_test.go |  5 +++++
+ 3 files changed, 16 insertions(+), 1 deletion(-)
+
+diff --git a/Makefile b/Makefile
+index d0938633329d..3b223135bed5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -82,7 +82,7 @@ umociimage:
+ .PHONY: test-unit
+ test-unit: umociimage
+ 	docker run --rm -it -v $(PWD):/go/src/$(PROJECT) --cap-add=SYS_ADMIN $(UMOCI_IMAGE) make local-test-unit
+-	docker run --rm -it -v $(PWD):/go/src/$(PROJECT) -u 1000:1000 --cap-drop=all $(UMOCI_IMAGE) go test -v $(PROJECT)/pkg/unpriv
++	docker run --rm -it -v $(PWD):/go/src/$(PROJECT) -u 1000:1000 --cap-drop=all $(UMOCI_IMAGE) make local-test-unit
+ 
+ .PHONY: local-test-unit
+ local-test-unit: umoci
+diff --git a/oci/cas/dir_test.go b/oci/cas/dir_test.go
+index 14eaf1799648..efddb14d23b6 100644
+--- a/oci/cas/dir_test.go
++++ b/oci/cas/dir_test.go
+@@ -40,6 +40,11 @@ import (
+ 
+ // readonly makes the given path read-only (by bind-mounting it as "ro").
+ func readonly(t *testing.T, path string) {
++	if os.Geteuid() != 0 {
++		t.Log("readonly tests only work with root privileges")
++		t.Skip()
++	}
++
+ 	t.Logf("mounting %s as readonly", path)
+ 
+ 	if err := syscall.Mount(path, path, "", syscall.MS_BIND|syscall.MS_RDONLY, ""); err != nil {
+@@ -52,6 +57,11 @@ func readonly(t *testing.T, path string) {
+ 
+ // readwrite undoes the effect of readonly.
+ func readwrite(t *testing.T, path string) {
++	if os.Geteuid() != 0 {
++		t.Log("readonly tests only work with root privileges")
++		t.Skip()
++	}
++
+ 	if err := syscall.Unmount(path, syscall.MNT_DETACH); err != nil {
+ 		t.Fatalf("unmount %s: %s", path, err)
+ 	}
+diff --git a/oci/layer/tar_extract_test.go b/oci/layer/tar_extract_test.go
+index a2af3ddade8b..81311b00e891 100644
+--- a/oci/layer/tar_extract_test.go
++++ b/oci/layer/tar_extract_test.go
+@@ -463,6 +463,11 @@ func TestUnpackHardlink(t *testing.T) {
+ 
+ // TestUnpackEntryMap checks that the mapOptions handling works.
+ func TestUnpackEntryMap(t *testing.T) {
++	if os.Geteuid() != 0 {
++		t.Log("mapOptions tests only work with root privileges")
++		t.Skip()
++	}
++
+ 	// TODO: Modify this to use subtests once Go 1.7 is in enough places.
+ 	func(t *testing.T) {
+ 		for _, test := range []struct {
+-- 
+2.11.0
+
diff --git a/umoci.changes b/umoci.changes
index d6763b0..8c67166 100644
--- a/umoci.changes
+++ b/umoci.changes
@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Tue Dec 20 08:10:00 UTC 2016 - asarai@suse.com
+
+- Add patch to allow running upstream's unit tests in a %check section. This
+  has already been merged upstream, this is just a backport. cyphar/umoci#65
+  + make-local-unit-tests-work-as-non-root.patch
+- Run upstream's unit tests in a %check section.
+
 -------------------------------------------------------------------
 Mon Dec 19 12:57:31 UTC 2016 - asarai@suse.com
 
diff --git a/umoci.spec b/umoci.spec
index 187c65f..375ba55 100644
--- a/umoci.spec
+++ b/umoci.spec
@@ -22,6 +22,9 @@
 # Remove stripping of Go binaries.
 %define __arch_install_post export NO_BRP_STRIP_DEBUG=true
 
+# Project name when using go tooling.
+%define project github.com/cyphar/umoci
+
 Name:           umoci
 Version:        0.0.0~rc3
 Release:        0
@@ -30,6 +33,8 @@ License:        Apache-2.0
 Group:          System/Management
 Url:            https://github.com/cyphar/umoci
 Source:         %{name}-%{version}.tar.xz
+# PATCH-FIX-UPSTREAM: Backport of cyphar/umoci#65, which is already upstream.
+Patch100:       make-local-unit-tests-work-as-non-root.patch
 %ifarch %{go_arches}
 BuildRequires:  go >= 1.6
 BuildRequires:  go-go-md2man
@@ -53,12 +58,18 @@ the Open Container Initiative community.
 
 %prep
 %setup -q
+# cyphar/umoci#65
+%patch100 -p1
 
 %build
 
-mkdir -p .gopath/src/github.com/cyphar
-ln -s $PWD .gopath/src/github.com/cyphar/umoci
-export GOPATH=$PWD/.gopath
+# We can't use symlinks here because go-list gets confused by symlinks, so we
+# have to copy the source to $HOME/go and then use that as the GOPATH.
+export GOPATH=$HOME/go
+mkdir -pv $HOME/go/src/%{project}
+rm -rf $HOME/go/src/%{project}/*
+cp -avr * $HOME/go/src/%{project}
+
 export VERSION="$(cat ./VERSION)"
 if [ "$VERSION" != "%{version}" ]; then
 	VERSION+="-%{version}"
@@ -86,6 +97,10 @@ done
 
 %fdupes %{buildroot}
 
+%check
+export GOPATH=$HOME/go
+go test -cover %{project}/...
+
 %files
 %defattr(-,root,root)
 %doc COPYING README.md man/*.md