--- shadow-4.1.5.1/lib/commonio.c.shadow_perms	2012-07-12 12:43:09.285419379 +0100
+++ shadow-4.1.5.1/lib/commonio.c	2012-07-12 12:43:35.309942373 +0100
@@ -50,6 +50,7 @@
 #endif				/* WITH_TCB */
 #include "prototypes.h"
 #include "commonio.h"
+#include <grp.h>
 
 /* local function prototypes */
 static int lrename (const char *, const char *);
@@ -913,6 +914,7 @@
 	char buf[1024];
 	int errors = 0;
 	struct stat sb;
+	struct group *grp;
 
 	if (!db->isopen) {
 		errno = EINVAL;
@@ -970,9 +972,12 @@
 		 * Default permissions for new [g]shadow files.
 		 * (passwd and group always exist...)
 		 */
-		sb.st_mode = 0400;
+		sb.st_mode = 0440;
 		sb.st_uid = 0;
-		sb.st_gid = 0;
+		if ((grp = getgrnam("shadow")) == NULL)
+		    sb.st_gid = 0;
+		else
+		    sb.st_gid = grp->gr_gid;
 	}
 
 	snprintf (buf, sizeof buf, "%s+", db->filename);