diff --git a/opencryptoki-1.17.0-p11sak.patch b/opencryptoki-1.17.0-p11sak.patch
new file mode 100644
index 0000000..c5bdba0
--- /dev/null
+++ b/opencryptoki-1.17.0-p11sak.patch
@@ -0,0 +1,13 @@
+diff -up opencryptoki-3.17.0/Makefile.am.me opencryptoki-3.17.0/Makefile.am
+--- opencryptoki-3.17.0/Makefile.am.me	2021-11-09 09:45:49.032661898 +0100
++++ opencryptoki-3.17.0/Makefile.am	2021-11-09 09:46:41.353400986 +0100
+@@ -76,7 +76,7 @@ if ENABLE_EP11TOK
+ endif
+ if ENABLE_P11SAK
+ 	test -f $(DESTDIR)$(sysconfdir)/opencryptoki || $(MKDIR_P) $(DESTDIR)$(sysconfdir)/opencryptoki || true
+-	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -g pkcs11 -m 0640 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
++	test -f $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || $(INSTALL) -m 0644 $(srcdir)/usr/sbin/p11sak/p11sak_defined_attrs.conf $(DESTDIR)$(sysconfdir)/opencryptoki/p11sak_defined_attrs.conf || true
+ endif
+ if ENABLE_ICATOK
+ 	cd $(DESTDIR)$(libdir)/opencryptoki/stdll && \
+diff -up opencryptoki-3.17.0/usr/sbin/p11sak/p11sak_defined_attrs.conf.me opencryptoki-3.17.0/usr/sbin/p11sak/p11sak_defined_attrs.conf
diff --git a/opencryptoki.spec b/opencryptoki.spec
index 830fce3..d3953b7 100644
--- a/opencryptoki.spec
+++ b/opencryptoki.spec
@@ -1,7 +1,7 @@
 Name:			opencryptoki
 Summary:		Implementation of the PKCS#11 (Cryptoki) specification v3.0
 Version:		3.17.0
-Release:		1%{?dist}
+Release:		2%{?dist}
 License:		CPL
 URL:			https://github.com/opencryptoki/opencryptoki
 Source0:		https://github.com/opencryptoki/%{name}/archive/v%{version}/%{name}-%{version}.tar.gz
@@ -12,6 +12,9 @@ Patch0:			opencryptoki-3.11.0-group.patch
 # bz#1373833, change tmpfiles snippets from /var/lock/* to /run/lock/*
 Patch1:			opencryptoki-3.11.0-lockdir.patch
 
+# add missing config file
+Patch2:			opencryptoki-1.17.0-p11sak.patch
+
 # Use --no-undefined to debug missing symbols
 #Patch100:			%%{name}-3.2-no-undefined.patch
 
@@ -228,6 +231,7 @@ fi
 %doc doc/README.token_data
 %dir %{_sysconfdir}/%{name}
 %config(noreplace) %{_sysconfdir}/%{name}/%{name}.conf
+%attr(0640, root, pkcs11) %config(noreplace) %{_sysconfdir}/%{name}/p11sak_defined_attrs.conf
 %{_tmpfilesdir}/%{name}.conf
 %{_unitdir}/pkcsslotd.service
 %{_sbindir}/p11sak
@@ -324,6 +328,9 @@ fi
 
 
 %changelog
+* Tue Nov 09 2021 Than Ngo <than@redhat.com> - 3.17.0-2
+- add missing config file p11sak_defined_attrs.conf
+
 * Tue Oct 19 2021 Than Ngo <than@redhat.com> - 3.17.0-1
 - rebase to 3.17.0