diff --git a/sudo.pp b/sudo.pp
index 5ed38f255..9dc4a69ba 100644
--- a/sudo.pp
+++ b/sudo.pp
@@ -189,20 +189,21 @@ still allow people to get their work done."
 	osdirs=`echo $osdirs | tr " " "\n" | sort -u`
 
 %files
-	$osdirs		       -
-	$bindir/sudo        4111 root:
-	$bindir/sudoedit    4111 root:
-	$sbindir/visudo     0111
-	$bindir/sudoreplay  0111
-	$includedir/sudo_plugin.h
-	$libexecdir/*		optional
+	$osdirs			-
+	$bindir/sudo        	4111 root:
+	$bindir/sudoedit    	4111 root:
+	$sbindir/visudo     	0111
+	$bindir/sudoreplay  	0111
+	$includedir/sudo_plugin.h 0444
+	$libexecdir/*		0755 optional
 	$sudoersdir/sudoers.d/	0750 $sudoers_uid:$sudoers_gid
 	$timedir/		0700 root:
 	$docdir/
-	$docdir/*
+	$docdir/sudoers2ldif	0555 optional,ignore-others
+	$docdir/*		0444
 	$localedir/		optional
-	$localedir/**		optional
-	/etc/pam.d/*		volatile,optional
+	$localedir/**		0444 optional
+	/etc/pam.d/*		0444 volatile,optional
 %if [rpm,deb]
 	$sudoersdir/sudoers $sudoers_mode $sudoers_uid:$sudoers_gid volatile
 %else