diff --git a/nsd.cron b/nsd.cron
index 38bbaf3..c7eb179 100644
--- a/nsd.cron
+++ b/nsd.cron
@@ -20,6 +20,9 @@ NSD_AUTOREBUILD="yes"
 # Read in local settings.
 [ -r /etc/sysconfig/nsd ] && . /etc/sysconfig/nsd
 
+# needed to avoid useless AVC rhbz#989218
+cd ~nsd
+
 # Ideally check if ixfr.db newer then any zones, only then do
 $NSDC_PROG -c $NSD_CONF patch > /dev/null 2>&1
 
diff --git a/nsd.init b/nsd.init
index 9263b3c..c402d1d 100755
--- a/nsd.init
+++ b/nsd.init
@@ -35,6 +35,9 @@ NSD_EXTRA_OPTS=""
 # Check that networking is configured.
 [ "${NETWORKING}" = "no" ] && exit 0
 
+# avoid AVC, see rhbz#989218
+cd /etc/nsd
+
 start() {
     # Source networking configuration.
     [ -r /etc/sysconfig/network ] && . /etc/sysconfig/network
diff --git a/nsd.spec b/nsd.spec
index 83661c4..f3d3ed1 100644
--- a/nsd.spec
+++ b/nsd.spec
@@ -1,7 +1,7 @@
 Summary: Fast and lean authoritative DNS Name Server
 Name: nsd
 Version: 3.2.16
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/%{name}/
 Source: http://www.nlnetlabs.nl/downloads/%{name}/%{name}-%{version}.tar.gz
@@ -105,6 +105,9 @@ if [ "$1" -ge "1" ]; then
 fi
 
 %changelog
+* Wed Jul 31 2013 Paul Wouters <pwouters@redhat.com> - 3.2.16-2
+- Avoid AVCs on directory scans, rhbz#989218
+
 * Mon Jul 22 2013 Paul Wouters <pwouters@redhat.com> - 3.2.16-1
 - Updated to 3.2.16
 - Added new option entries to nsd.conf