diff --git a/krb5-1.7-selinux-label.patch b/krb5-1.7-selinux-label.patch
index 106af6d..0e967a6 100644
--- a/krb5-1.7-selinux-label.patch
+++ b/krb5-1.7-selinux-label.patch
@@ -356,6 +356,24 @@ diff -up krb5-1.7/src/plugins/kdb/db2/kdb_db2.c krb5-1.7/src/plugins/kdb/db2/kdb
  	    retval = errno;
  	    goto err_out;
  	}
+@@ -754,7 +754,7 @@ krb5_db2_db_create(krb5_context context,
+     if (!okname)
+ 	retval = ENOMEM;
+     else {
+-	fd = open(okname, O_CREAT | O_RDWR | O_TRUNC, 0600);
++	fd = THREEPARAMOPEN(okname, O_CREAT | O_RDWR | O_TRUNC, 0600);
+ 	if (fd < 0)
+ 	    retval = errno;
+ 	else
+@@ -1795,7 +1795,7 @@ krb5_db2_db_rename(context, from, to)
+ 	retval = ENOMEM;
+ 	goto errout;
+     }
+-    db_ctx->db_lf_file = open(db_ctx->db_lf_name, O_RDWR|O_CREAT, 0600);
++    db_ctx->db_lf_file = THREEPARAMOPEN(db_ctx->db_lf_name, O_RDWR|O_CREAT, 0600);
+     if (db_ctx->db_lf_file < 0) {
+ 	retval = errno;
+ 	goto errout;
 diff -up krb5-1.7/src/plugins/kdb/db2/libdb2/btree/bt_open.c krb5-1.7/src/plugins/kdb/db2/libdb2/btree/bt_open.c
 --- krb5-1.7/src/plugins/kdb/db2/libdb2/btree/bt_open.c	2007-10-22 15:18:53.000000000 -0400
 +++ krb5-1.7/src/plugins/kdb/db2/libdb2/btree/bt_open.c	2009-06-04 13:47:20.000000000 -0400
diff --git a/krb5.spec b/krb5.spec
index a0857fb..5bfca93 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -10,7 +10,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.7.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 # Maybe we should explode from the now-available-to-everybody tarball instead?
 # http://web.mit.edu/kerberos/dist/krb5/1.7/krb5-1.7.1-signed.tar
 Source0: krb5-%{version}.tar.gz
@@ -850,6 +850,9 @@ exit 0
 %{krb5prefix}/sbin/uuserver
 
 %changelog
+* Tue Mar  2 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-5
+- fix a regression (not labeling a kdb database lock file correctly, #569902)
+
 * Thu Feb 25 2010 Nalin Dahyabhai <nalin@redhat.com> - 1.7.1-4
 - move the package changelog to the end to match the usual style (jdennis)
 - scrub out references to $RPM_SOURCE_DIR (jdennis)