diff --git a/grub.macros b/grub.macros
index 2bdc2ef..425012a 100644
--- a/grub.macros
+++ b/grub.macros
@@ -18,7 +18,6 @@
 	sed							\\\
 		-e 's/-O. //g'					\\\
 		-e 's/-g /-g3 /g'				\\\
-		-e 's/-fstack-clash-protection //g'		\\\
 		-e 's/-fplugin=annobin //g'			\\\
 		-e 's,-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 ,,g' \\\
 		-e 's/-fstack-protector[[:alpha:]-]\\+//g'	\\\
@@ -28,7 +27,6 @@
 		-e 's/-fexceptions//g'				\\\
 		-e 's/-fasynchronous-unwind-tables//g'		\\\
 		-e 's/^/ -fno-strict-aliasing /'		\\\
-		-e 's/^/ -fno-stack-clash-protection /'		\\\
 		%{nil}
 
 %global efi_cflags						\\\
@@ -494,7 +492,7 @@ touch ${RPM_BUILD_ROOT}/boot/%{name}/grub.cfg			\
 %config(noreplace) %{_sysconfdir}/%{name}-efi.cfg		\
 %dir %attr(0700,root,root)/boot/efi/EFI/%{efidir}		\
 %attr(0700,root,root)/boot/efi/EFI/%{efidir}/%{2}		\
-%attr(0755,root,root)/boot/efi/EFI/%{efidir}/fonts		\
+%attr(0700,root,root)/boot/efi/EFI/%{efidir}/fonts		\
 %ghost %config(noreplace) %attr(0700,root,root)/boot/efi/EFI/%{efidir}/grub.cfg	\
 /boot/grub2/grubenv						\
 %ghost %config(noreplace) %attr(0700,root,root)/boot/efi/EFI/%{efidir}/grubenv \
diff --git a/grub2.spec b/grub2.spec
index 14747ac..4155714 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -7,7 +7,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.02
-Release:	22%{?dist}
+Release:	23%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 Group:		System Environment/Base
 License:	GPLv3+
@@ -454,6 +454,11 @@ fi
 %endif
 
 %changelog
+* Fri Jan 19 2018 Peter Jones <pjones@redhat.com> - 2.02-23
+- Only nerf annobin, not -fstack-crash-protection.
+- Fix a conflict on /boot/efi directory permissions between -cdboot and the
+  normal bootloader.
+
 * Thu Jan 18 2018 Peter Jones <pjones@redhat.com> - 2.02-22
 - Nerf some gcc 7.2.1-6 'features' that cause grub to crash on start.