diff --git a/SOURCES/gssproxy-0.5.1-socket_permission_checking.patch b/SOURCES/gssproxy-0.5.1-socket_permission_checking.patch
new file mode 100644
index 0000000..1aa84b2
--- /dev/null
+++ b/SOURCES/gssproxy-0.5.1-socket_permission_checking.patch
@@ -0,0 +1,73 @@
+From bbda272145ebbe0cbb65467c1573e583b9e1b7c7 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Fri, 3 Jun 2016 14:30:36 +0000
+Subject: [PATCH] Use new socket if uid, pid, or gid changes
+
+The gssproxy daemon uses SO_PEERCRED to determine credentials of the
+connecting process.  However, these credentials are set only at the time
+connect has called.  Therefore they must be reset every time uid or pid
+changes.  For completeness, we check gid as well.
+
+Signed-off-by: Robbie Harwood <rharwood@redhat.com>
+Reviewed-by: Simo Sorce <simo@redhat.com>
+Closes #27
+---
+ proxy/src/client/gpm_common.c | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/proxy/src/client/gpm_common.c b/proxy/src/client/gpm_common.c
+index cb4ccdb..0a54dbc 100644
+--- a/proxy/src/client/gpm_common.c
++++ b/proxy/src/client/gpm_common.c
+@@ -13,6 +13,12 @@
+ struct gpm_ctx {
+     pthread_mutex_t lock;
+     int fd;
++
++    /* these are only meaningful if fd != -1 */
++    pid_t pid;
++    uid_t uid;
++    gid_t gid;
++
+     int next_xid;
+ };
+ 
+@@ -93,6 +99,9 @@ done:
+         }
+     }
+     gpmctx->fd = fd;
++    gpmctx->pid = getpid();
++    gpmctx->uid = geteuid();
++    gpmctx->gid = getegid();
+     return ret;
+ }
+ 
+@@ -120,12 +129,25 @@ static void gpm_close_socket(struct gpm_ctx *gpmctx)
+ static int gpm_grab_sock(struct gpm_ctx *gpmctx)
+ {
+     int ret;
++    pid_t p;
++    uid_t u;
++    gid_t g;
+ 
+     ret = pthread_mutex_lock(&gpmctx->lock);
+     if (ret) {
+         return ret;
+     }
+ 
++    /* Detect fork / setresuid and friends */
++    p = getpid();
++    u = geteuid();
++    g = getegid();
++
++    if (gpmctx->fd != -1 &&
++        (p != gpmctx->pid || u != gpmctx->uid || g != gpmctx->gid)) {
++        gpm_close_socket(gpmctx);
++    }
++
+     if (gpmctx->fd == -1) {
+         ret = gpm_open_socket(gpmctx);
+     }
+-- 
+2.8.1
+
diff --git a/SPECS/gssproxy.spec b/SPECS/gssproxy.spec
index 6c38dad..b86a1b0 100644
--- a/SPECS/gssproxy.spec
+++ b/SPECS/gssproxy.spec
@@ -1,6 +1,6 @@
 Name:		gssproxy
 Version:	0.4.1
-Release:	7%{?dist}
+Release:	8%{?dist}
 Summary:	GSSAPI Proxy
 
 Group:		System Environment/Libraries
@@ -19,6 +19,7 @@ Patch2: gssproxy_ticket_147_0001-Add-PIE-and-RELRO-compiler-flags-for-hardening.
 Patch3: gssproxy_ticket_145_130-Set-default-rcache.patch
 Patch4: gssproxy_ticket_143_workaround_Service-HTTP.patch
 Patch5: 0001-Correct-handling-of-EINTR-on-read-write.patch
+Patch8: gssproxy-0.5.1-socket_permission_checking.patch
 
 ### Dependencies ###
 
@@ -65,6 +66,7 @@ A proxy for GSSAPI credential handling
 %patch3 -p2 -b .gssproxy_ticket_145_130-set-default-rcache
 %patch4 -p2 -b .gssproxy_ticket_143_workaround_service-http
 %patch5 -p2 -b .gssproxy_EINTR_loop_fix
+%patch8 -p2 -b .socket_permission_checking
 
 %build
 autoreconf -f -i
@@ -121,6 +123,10 @@ rm -rf -- "%{buildroot}"
 
 
 %changelog
+* Tue Jun 07 2016 Robbie Harwood <rharwood@redhat.com> 0.4.1-8
+- Re-open socket in mechglue if client forks/changes privilege
+- Resolves: #1351318
+
 * Tue Sep 29 2015 Simo Sorce <simo@redhat.com> 0.4.1-7
 - Fix loop cause by imporper EINTR handling
 - resolves: #1266564