diff --git a/Makefile.am b/Makefile.am
index 60bc67f1ac6..02b087ea37b 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2844,6 +2844,11 @@ else
 	$(MKDIR_P) $(DESTDIR)$(initdir)
 endif
 
+if SSSD_USER
+	chgrp $(SSSD_USER) $(sssdlibexecdir)/ldap_child
+	chmod 4750 $(sssdlibexecdir)/ldap_child
+endif
+
 install-data-hook:
 	rm $(DESTDIR)/$(nsslibdir)/libnss_sss.so.2 \
        $(DESTDIR)/$(nsslibdir)/libnss_sss.so
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index db3bbcb09d6..d2e6cec2610 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -645,7 +645,7 @@ rm -rf $RPM_BUILD_ROOT
 %defattr(-,root,root,-)
 %doc COPYING
 %{_libdir}/%{name}/libsss_krb5_common.so
-%{_libexecdir}/%{servicename}/ldap_child
+%attr(4750,root,sssd) %{_libexecdir}/%{servicename}/ldap_child
 %{_libexecdir}/%{servicename}/krb5_child
 
 %files krb5 -f sssd_krb5.lang