diff --git a/SOURCES/00001-fix-dbus-policy.patch b/SOURCES/00001-fix-dbus-policy.patch
new file mode 100644
index 0000000..ee8bc45
--- /dev/null
+++ b/SOURCES/00001-fix-dbus-policy.patch
@@ -0,0 +1,99 @@
+diff --git a/etc-conf/dbus/system.d/com.redhat.RHSM1.conf b/etc-conf/dbus/system.d/com.redhat.RHSM1.conf
+index e21c57263..11adf1d79 100644
+--- a/etc-conf/dbus/system.d/com.redhat.RHSM1.conf
++++ b/etc-conf/dbus/system.d/com.redhat.RHSM1.conf
+@@ -7,23 +7,9 @@
+     <policy user="root">
+         <allow own="com.redhat.RHSM1"/>
+ 
+-        <!-- Basic D-Bus API stuff -->
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="org.freedesktop.DBus.Introspectable"/>
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="org.freedesktop.DBus.Properties"/>
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="org.freedesktop.DBus.ObjectManager"/>
+-
+-        <!-- allow Config.Set from root -->
+-        <allow send_destination="com.redhat.RHSM1"
+-            send_interface="com.redhat.RHSM1.Config"
+-            send_member="Set"/>
+-    </policy>
+-
+-
+-    <policy context="default">
+-        <!-- TODO: make these read-only by default -->
++        <!--
++        Lock down the objects to root access only
++        -->
+ 
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="com.redhat.RHSM1"/>
+@@ -37,11 +23,6 @@
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="com.redhat.RHSM1.Config"/>
+ 
+-        <!-- deny Config.Set by default -->
+-        <deny send_destination="com.redhat.RHSM1"
+-            send_interface="com.redhat.RHSM1.Config"
+-            send_member="Set"/>
+-
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="com.redhat.RHSM1.RegisterServer"/>
+ 
+@@ -65,5 +46,54 @@
+         <allow send_destination="com.redhat.RHSM1"
+             send_interface="org.freedesktop.DBus.ObjectManager"/>
+     </policy>
+-</busconfig>
+ 
++
++    <policy context="default">
++
++        <!--
++        Non-root users can execute only methods providing
++        information from files readable by non-root users.
++        -->
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Entitlement"
++            send_member="GetStatus"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Products"
++            send_member="ListInstalledProducts"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Syspurpose"
++            send_member="GetSyspurpose"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Syspurpose"
++            send_member="GetSyspurposeStatus"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Config"
++            send_member="GetAll"/>
++
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Config"
++            send_member="Get"/>
++
++        <!--
++        The UUID returned by following method is read
++        from consumer cert. Only this file is not
++        readable by non-root users.
++        -->
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="com.redhat.RHSM1.Consumer"
++            send_member="GetUuid"/>
++
++        <!-- Basic D-Bus API stuff -->
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="org.freedesktop.DBus.Introspectable"/>
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="org.freedesktop.DBus.Properties"/>
++        <allow send_destination="com.redhat.RHSM1"
++            send_interface="org.freedesktop.DBus.ObjectManager"/>
++    </policy>
++</busconfig>
diff --git a/SPECS/subscription-manager.spec b/SPECS/subscription-manager.spec
index c67d9c4..cec5c01 100644
--- a/SPECS/subscription-manager.spec
+++ b/SPECS/subscription-manager.spec
@@ -245,7 +245,7 @@
 
 Name: subscription-manager
 Version: 1.28.36
-Release: 2%{?dist}.alma
+Release: 3%{?dist}.alma.1
 Summary: Tools and libraries for subscription and repository management
 %if 0%{?suse_version}
 Group:   Productivity/Networking/System
@@ -412,6 +412,9 @@ Obsoletes: subscription-manager-initial-setup-addon
 Obsoletes: rhsm-gtk
 Obsoletes: rhsm-icons
 
+
+Patch00001: 00001-fix-dbus-policy.patch
+
 %description
 The Subscription Manager package provides programs and libraries to allow users
 to manage subscriptions and yum repositories from the EL entitlement
@@ -769,9 +772,7 @@ cloud metadata and signatures.
 
 %prep
 %setup -q
-%patch100 -p1
-%patch101 -p1
-%patch102 -p1
+%autopatch -p1
 
 %build
 make -f Makefile VERSION=%{version}-%{release} CFLAGS="%{optflags}" \
@@ -1514,9 +1515,12 @@ gtk-update-icon-cache -f %{_datadir}/icons/hicolor &>/dev/null || :
 %endif
 
 %changelog
-* Wed May 17 2023 Andrew Lukoshko <alukoshko@almalinux.org> - 1.28.36-2.alma
+* Wed Aug 23 2023 Eduard Abdullin <eabdullin@almalinux.org> - 1.28.36-3.alma.1
 - Debrand for AlmaLinux
 
+* Tue Aug 08 2023 Jiri Hnidek <jhnidek@redhat.com> 1.28.36-3
+- 2225442: Fix D-Bus policy (jhnidek@redhat.com)
+
 * Wed Feb 22 2023 Pino Toscano <ptoscano@redhat.com> 1.28.36-2
 - Translated using Weblate (French) (ljanda@redhat.com)
 - Translated using Weblate (French) (suanand@redhat.com)