diff --git a/rsync-3.2.3-xattr.patch b/rsync-3.2.3-xattr.patch
new file mode 100644
index 0000000..91b77c2
--- /dev/null
+++ b/rsync-3.2.3-xattr.patch
@@ -0,0 +1,38 @@
+diff --git a/xattrs.c b/xattrs.c
+index 508649c0..3c549192 100644
+--- a/xattrs.c
++++ b/xattrs.c
+@@ -1055,7 +1055,7 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna
+ {
+ 	rsync_xa_list *glst = rsync_xal_l.items;
+ 	item_list *lst;
+-	int ndx;
++	int ndx, added_write_perm = 0;
+ 
+ 	if (dry_run)
+ 		return 1; /* FIXME: --dry-run needs to compute this value */
+@@ -1084,10 +1084,23 @@ int set_xattr(const char *fname, const struct file_struct *file, const char *fna
+ 	}
+ #endif
+ 
++	/* If the target file lacks write permission, we try to add it
++	 * temporarily so we can change the extended attributes. */
++	if (!am_root
++#ifdef SUPPORT_LINKS
++	 && !S_ISLNK(sxp->st.st_mode)
++#endif
++	 && access(fname, W_OK) < 0
++	 && do_chmod(fname, (sxp->st.st_mode & CHMOD_BITS) | S_IWUSR) == 0)
++		added_write_perm = 1;
++
+ 	ndx = F_XATTR(file);
+ 	glst += ndx;
+ 	lst = &glst->xa_items;
+-	return rsync_xal_set(fname, lst, fnamecmp, sxp);
++	int return_value = rsync_xal_set(fname, lst, fnamecmp, sxp);
++	if (added_write_perm) /* remove the temporary write permission */
++		do_chmod(fname, sxp->st.st_mode);
++	return return_value;
+ }
+ 
+ #ifdef SUPPORT_ACLS
diff --git a/rsync.spec b/rsync.spec
index 8888de9..e3f5853 100644
--- a/rsync.spec
+++ b/rsync.spec
@@ -10,7 +10,7 @@
 Summary: A program for synchronizing files over a network
 Name: rsync
 Version: 3.2.3
-Release: 9%{?dist}
+Release: 10%{?dist}
 URL: https://rsync.samba.org/
 
 Source0: https://download.samba.org/pub/rsync/src/rsync-%{version}%{?prerelease}.tar.gz
@@ -35,6 +35,7 @@ Patch0: rsync-3.2.2-ssl-verify-hostname.patch
 Patch1: rsync-3.2.2-runtests.patch
 Patch2: rsync-3.2.3-lchmod.patch
 Patch3: rsync-3.2.3-append-mode.patch
+Patch4: rsync-3.2.3-xattr.patch
 
 %description
 Rsync uses a reliable algorithm to bring remote and host files into
@@ -72,6 +73,7 @@ patch -p1 -i patches/copy-devices.diff
 %patch1 -p1 -b .runtests
 %patch2 -p1 -b .lchmod
 %patch3 -p1 -b .append-mode
+%patch4 -p1 -b .xattr
 
 %build
 %configure --disable-xxhash
@@ -118,6 +120,9 @@ install -D -m644 %{SOURCE6} $RPM_BUILD_ROOT/%{_unitdir}/rsyncd@.service
 %systemd_postun_with_restart rsyncd.service
 
 %changelog
+* Fri Apr 22 2022 Michal Ruprich <mruprich@redhat.com> - 3.2.3-10
+- Resolves: #2077431 - Read-only files that have changed xattrs fail to allow xattr changes
+
 * Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 3.2.3-9
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
   Related: rhbz#1991688