diff --git a/.gitignore b/.gitignore
index dfc4c7e..6ba73a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -92,3 +92,4 @@
 /cups-filters-1.22.3.tar.xz
 /cups-filters-1.22.5.tar.xz
 /cups-filters-1.26.0.tar.xz
+/cups-filters-1.27.0.tar.xz
diff --git a/cups-filters.spec b/cups-filters.spec
index 84bb788..9213fc7 100644
--- a/cups-filters.spec
+++ b/cups-filters.spec
@@ -3,7 +3,7 @@
 
 Summary: OpenPrinting CUPS filters and backends
 Name:    cups-filters
-Version: 1.26.0
+Version: 1.27.0
 Release: 1%{?dist}
 
 # For a breakdown of the licensing, see COPYING file
@@ -236,11 +236,13 @@ done
 %{_pkgdocdir}/NEWS
 %config(noreplace) %{_sysconfdir}/cups/cups-browsed.conf
 %attr(0755,root,root) %{_cups_serverbin}/filter/*
-%attr(0755,root,root) %{_cups_serverbin}/backend/parallel
+# all backends needs to be run only as root because of kerberos
+%attr(0700,root,root) %{_cups_serverbin}/backend/parallel
 # Serial backend needs to run as root (bug #212577#c4).
 %attr(0700,root,root) %{_cups_serverbin}/backend/serial
-%attr(0755,root,root) %{_cups_serverbin}/backend/implicitclass
-%attr(0755,root,root) %{_cups_serverbin}/backend/beh
+# implicitclass backend must be run as root
+%attr(0700,root,root) %{_cups_serverbin}/backend/implicitclass
+%attr(0700,root,root) %{_cups_serverbin}/backend/beh
 # cups-brf needs to be run as root, otherwise it leaves error messages
 # in journal
 %attr(0700,root,root) %{_cups_serverbin}/backend/cups-brf
@@ -300,8 +302,8 @@ done
 %{_libdir}/libfontembed.so
 
 %changelog
-* Mon Dec 16 2019 Zdenek Dohnal <zdohnal@redhat.com> - 1.26.0-1
-- 1.26.0
+* Tue Jan 28 2020 Zdenek Dohnal <zdohnal@redhat.com> - 1.27.0-1
+- 1.27.0
 - add post scriptlet for update
 
 * Tue Nov 26 2019 Zdenek Dohnal <zdohnal@redhat.com> - 1.22.5-10
diff --git a/sources b/sources
index a499d72..d36b49a 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (cups-filters-1.26.0.tar.xz) = a6e0a1b8dfec2e46cb2475639b33f60da3a74090718334883564711530e13c7524952b9f145303c1063e1ae21eb585dce1fd9c87e4ce7884ec687fdef58f2124
+SHA512 (cups-filters-1.27.0.tar.xz) = f49d9c3e558cd3ac7d5eb0bf323940e7bb3c088a24ef9232cde2cb84ddc0e262c77acd29eb97851ca4e3bd473d764e730480808f9c1d95b1dd6d406073614702