diff --git a/openvswitch.changes b/openvswitch.changes
index 0ade8b7..76ca2c7 100644
--- a/openvswitch.changes
+++ b/openvswitch.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Thu Mar 22 10:39:10 UTC 2018 - mchandras@suse.de
+
+- Fix file permissions in /etc/openvswitch for upgrades (951d79e638ec)
+
 -------------------------------------------------------------------
 Wed Mar 21 21:03:21 UTC 2018 - dmueller@suse.com
 
diff --git a/openvswitch.spec b/openvswitch.spec
index 38fbdac..8a0b81e 100644
--- a/openvswitch.spec
+++ b/openvswitch.spec
@@ -575,6 +575,13 @@ export DISABLE_RESTART_ON_UPDATE=yes
 %postun vtep -p /sbin/ldconfig
 
 %files
+%defattr(-,openvswitch,openvswitch)
+%dir %{_sysconfdir}/openvswitch
+%{_sysconfdir}/openvswitch/default.conf
+%config %ghost %{_sysconfdir}/openvswitch/conf.db
+%ghost %{_sysconfdir}/openvswitch/.conf.db.~lock~
+%config %ghost %{_sysconfdir}/openvswitch/system-id.conf
+%defattr(-,root,root)
 %{_bindir}/ovs-appctl
 %{_bindir}/ovs-docker
 %{_bindir}/ovs-dpctl
@@ -614,10 +621,6 @@ export DISABLE_RESTART_ON_UPDATE=yes
 %{_mandir}/man8/ovs-vswitchd.8%{ext_man}
 %{_sysconfdir}/bash_completion.d/ovs-appctl-bashcomp.bash
 %{_sysconfdir}/bash_completion.d/ovs-vsctl-bashcomp.bash
-%dir %{_sysconfdir}/openvswitch
-%config(noreplace) %{_sysconfdir}/openvswitch/default.conf
-%config %ghost %{_sysconfdir}/openvswitch/conf.db
-%config %ghost %{_sysconfdir}/openvswitch/system-id.conf
 %config(noreplace) %{_sysconfdir}/logrotate.d/openvswitch
 %{_sbindir}/rcovsdb-server
 %{_sbindir}/rcovs-vswitchd
@@ -626,7 +629,7 @@ export DISABLE_RESTART_ON_UPDATE=yes
 %{_unitdir}/ovs-vswitchd.service
 %{_unitdir}/ovsdb-server.service
 %{_fillupdir}/sysconfig.openvswitch
-%dir %{_localstatedir}/log/openvswitch
+%attr(755,-,-) %dir %{_localstatedir}/log/openvswitch
 %if %{with dpdk}
 %{_prefix}/lib/udev/rules.d/91-vfio.rules
 %endif