diff --git a/0001-deploy-Actually-copy-xattrs-of-modified-config-files.patch b/0001-deploy-Actually-copy-xattrs-of-modified-config-files.patch
new file mode 100644
index 0000000..e7eb8a4
--- /dev/null
+++ b/0001-deploy-Actually-copy-xattrs-of-modified-config-files.patch
@@ -0,0 +1,48 @@
+From 1ab7cbea678be3769cd00d94ba0be6beb0ce67b9 Mon Sep 17 00:00:00 2001
+From: Colin Walters <walters@verbum.org>
+Date: Sat, 3 Jan 2015 12:14:11 -0500
+Subject: [PATCH] deploy: Actually copy xattrs of modified config files
+
+Regression from 7b01bd2e4333d4346dd08e0b5caf672f56b1ccfd
+where we stopped using g_file_copy() - we lost copying xattrs.
+
+This specifically breaks /etc/shadow SELinux labeling, with the
+obvious bad consequences.
+---
+ src/libostree/ostree-sysroot-deploy.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+diff --git a/src/libostree/ostree-sysroot-deploy.c b/src/libostree/ostree-sysroot-deploy.c
+index 40dd7b5..c7a1d68 100644
+--- a/src/libostree/ostree-sysroot-deploy.c
++++ b/src/libostree/ostree-sysroot-deploy.c
+@@ -93,6 +93,13 @@ copy_one_file_fsync_at (int              src_parent_dfd,
+         }
+       out = g_unix_output_stream_new (dest_fd, TRUE);
+ 
++      if (src_xattrs != NULL)
++        {
++          if (!gs_dfd_and_name_set_all_xattrs (dest_parent_dfd, name, src_xattrs,
++                                               cancellable, error))
++            goto out;
++        }
++
+       if (g_output_stream_splice (out, in, 0, cancellable, error) < 0)
+         goto out;
+ 
+@@ -134,6 +141,12 @@ copy_one_file_fsync_at (int              src_parent_dfd,
+           ot_util_set_error_from_errno (error, errno);
+           goto out;
+         }
++      if (src_xattrs != NULL)
++        {
++          if (!gs_dfd_and_name_set_all_xattrs (dest_parent_dfd, name, src_xattrs,
++                                               cancellable, error))
++            goto out;
++        }
+       if (fchownat (dest_parent_dfd, name,
+                     stbuf->st_uid, stbuf->st_gid,
+                     AT_SYMLINK_NOFOLLOW) != 0)
+-- 
+1.8.3.1
+
diff --git a/ostree.spec b/ostree.spec
index 8c550aa..27e2d3b 100644
--- a/ostree.spec
+++ b/ostree.spec
@@ -1,10 +1,11 @@
 Summary: Tool for managing bootable, immutable filesystem trees
 Name: ostree
 Version: 2014.13
-Release: 1%{?dist}
+Release: 2%{?dist}
 #VCS: git:git://git.gnome.org/ostree
 Source0: http://ftp.gnome.org/pub/GNOME/sources/ostree/%{version}/ostree-%{version}.tar.xz
 Source1: 91-ostree.preset
+Patch0: 0001-deploy-Actually-copy-xattrs-of-modified-config-files.patch
 License: LGPLv2+
 URL: http://live.gnome.org/OSTree
 
@@ -57,6 +58,7 @@ GRUB2 integration for OSTree
 
 %prep
 %setup -q -n ostree-%{version}
+%patch0 -p1
 
 %build
 env NOCONFIGURE=1 ./autogen.sh
@@ -109,6 +111,10 @@ rm -rf $RPM_BUILD_ROOT
 %{_libexecdir}/ostree/grub2*
 
 %changelog
+* Sun Jan 04 2015 Colin Walters <walters@redhat.com> - 2014.13-2
+- Add patch to ensure correct xattrs on modified config files
+  Fixes: #1178208
+
 * Wed Dec 17 2014 Colin Walters <walters@redhat.com> - 2014.13-1
 - New upstream release