--- shadow-4.0.12/lib/commonio.c.org	2008-08-27 11:45:59.000000000 -0600
+++ shadow-4.0.12/lib/commonio.c	2008-08-27 11:53:35.000000000 -0600
@@ -23,6 +23,7 @@ RCSID ("$Id: commonio.c,v 1.28 2005/03/3
 static security_context_t old_context = NULL;
 #endif
 #include "commonio.h"
+#include <grp.h>
 
 /* local function prototypes */
 static int check_link_count (const char *);
@@ -628,6 +629,7 @@ int commonio_close (struct commonio_db *
 	char buf[1024];
 	int errors = 0;
 	struct stat sb;
+	struct group *grp;
 
 	if (!db->isopen) {
 		errno = EINVAL;
@@ -682,9 +684,12 @@ int commonio_close (struct commonio_db *
 		 * Default permissions for new [g]shadow files.
 		 * (passwd and group always exist...)
 		 */
-		sb.st_mode = 0400;
+		sb.st_mode = 0440;
 		sb.st_uid = 0;
-		sb.st_gid = 0;
+		if ((grp = getgrnam("shadow")) == NULL)
+		    sb.st_gid = 0;
+		else
+		    sb.st_gid = grp->gr_gid;
 	}
 
 	snprintf (buf, sizeof buf, "%s+", db->filename);