diff --git a/pam_mount-0.47-fix-deny_ok.dif b/pam_mount-0.47-fix-deny_ok.dif
new file mode 100644
index 0000000..26f42bb
--- /dev/null
+++ b/pam_mount-0.47-fix-deny_ok.dif
@@ -0,0 +1,11 @@
+--- src/rdconf2.c
++++ src/rdconf2.c	2008/10/14 10:35:21
+@@ -102,7 +102,7 @@
+ 		return false;
+ 
+ 	while ((e = HXbtraverse(t)) != NULL)
+-		if (!kvplist_contains(options, e->key)) {
++		if (kvplist_contains(options, e->key)) {
+ 			l0g("option \"%s\" denied\n",
+ 			    static_cast(const char *, e->key));
+ 			HXbtrav_free(t);
diff --git a/pam_mount.changes b/pam_mount.changes
index b24d1e9..ae315f4 100644
--- a/pam_mount.changes
+++ b/pam_mount.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Tue Oct 14 17:43:19 CEST 2008 - mc@suse.de
+
+- fix checking deny options 
+
 -------------------------------------------------------------------
 Mon Oct 13 16:21:01 CEST 2008 - mc@suse.de
 
diff --git a/pam_mount.spec b/pam_mount.spec
index 5b28f5f..41b5577 100644
--- a/pam_mount.spec
+++ b/pam_mount.spec
@@ -23,7 +23,7 @@ BuildRequires:  libHX-devel libxml2-devel lzma openssl-devel pam-devel perl-XML-
 BuildRequires:  linux-kernel-headers
 Summary:        A PAM Module that can Mount Volumes for a User Session
 Version:        0.47
-Release:        9
+Release:        10
 # psmisc: /bin/fuser
 Recommends:     cifs-mount psmisc
 Recommends:     cryptsetup
@@ -35,6 +35,7 @@ Source:         %{name}-%{version}.tar.lzma
 Patch1:         pam_mount-0.45-umount-home-dir.dif
 Patch2:         pam_mount-0.47-fix-decrypt-key.dif
 Patch3:         pam_mount-0.47-fix-replace-options.dif
+Patch4:         pam_mount-0.47-fix-deny_ok.dif
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 Url:            http://pam-mount.sourceforge.net/
 PreReq:         coreutils, perl-XML-Writer
@@ -73,6 +74,7 @@ include it and send me patches.
 %patch1
 %patch2
 %patch3
+%patch4
 
 %build
 %{suse_update_config -f}
@@ -132,6 +134,8 @@ rm -rf $RPM_BUILD_ROOT
 %doc %{_mandir}/man8/umount.crypt.8.gz
 
 %changelog
+* Tue Oct 14 2008 mc@suse.de
+- fix checking deny options
 * Mon Oct 13 2008 mc@suse.de
 - replace also options which are specified in a volume
   (bnc#433845)