diff --git a/nginx-1.12.1-logs-perm.patch b/nginx-1.12.1-logs-perm.patch
new file mode 100644
index 0000000..4884a84
--- /dev/null
+++ b/nginx-1.12.1-logs-perm.patch
@@ -0,0 +1,13 @@
+diff --git a/src/core/ngx_cycle.c b/src/core/ngx_cycle.c
+index aee7a58..bcceecb 100644
+--- a/src/core/ngx_cycle.c
++++ b/src/core/ngx_cycle.c
+@@ -1108,7 +1108,7 @@ ngx_reopen_files(ngx_cycle_t *cycle, ngx_uid_t user)
+         }
+ 
+         fd = ngx_open_file(file[i].name.data, NGX_FILE_APPEND,
+-                           NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS);
++                           NGX_FILE_CREATE_OR_OPEN, NGX_FILE_DEFAULT_ACCESS | 0220);
+ 
+         ngx_log_debug3(NGX_LOG_DEBUG_EVENT, cycle->log, 0,
+                        "reopen file \"%s\", old:%d new:%d",
diff --git a/nginx.logrotate b/nginx.logrotate
index cffa62e..353da6e 100644
--- a/nginx.logrotate
+++ b/nginx.logrotate
@@ -1,5 +1,5 @@
 /var/log/nginx/*log {
-    create 0644 nginx nginx
+    create 0664 nginx root
     daily
     rotate 10
     missingok
diff --git a/nginx.spec b/nginx.spec
index 4c625f3..1626b57 100644
--- a/nginx.spec
+++ b/nginx.spec
@@ -21,7 +21,7 @@
 Name:              nginx
 Epoch:             1
 Version:           1.12.1
-Release:           7%{?dist}
+Release:           8%{?dist}
 
 Summary:           A high performance web server and reverse proxy server
 Group:             System Environment/Daemons
@@ -53,6 +53,10 @@ Patch0:            nginx-auto-cc-gcc.patch
 # not needed with libxcrypt anyways.
 Patch1:            0001-unix-ngx_user-Apply-fix-for-really-old-bug-in-glibc-.patch
 
+# downstream patch - changing logs permissions to 664 instead
+# previous 644
+Patch2:            nginx-1.12.1-logs-perm.patch
+
 %if 0%{?with_gperftools}
 BuildRequires:     gperftools-devel
 %endif
@@ -183,6 +187,7 @@ Requires:          nginx
 %setup -q
 %patch0 -p0
 %patch1 -p1
+%patch2 -p1
 cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} .
 
 %if 0%{?rhel} > 0 && 0%{?rhel} < 8
@@ -445,6 +450,9 @@ fi
 
 
 %changelog
+* Mon May 14 2018 Luboš Uhliarik <luhliari@redhat.com> - 1:1.12.1-8
+- Related: #1573942 - nginx fails on start
+
 * Wed May 02 2018 Luboš Uhliarik <luhliari@redhat.com> - 1:1.12.1-7
 - Resolves: #1573942 - nginx fails on start