diff --git a/0003-enable-external-linkmode-for-cgo-build.patch b/0003-enable-external-linkmode-for-cgo-build.patch
new file mode 100644
index 0000000000000000000000000000000000000000..cf75a53439fbf206ea238fe0538a3990e1aa63ff
--- /dev/null
+++ b/0003-enable-external-linkmode-for-cgo-build.patch
@@ -0,0 +1,37 @@
+From cdf9cf499f84376f42b71c69b92abbc6e79b9803 Mon Sep 17 00:00:00 2001
+From: zhangsong234 <zhangsong34@huawei.com>
+Date: Mon, 22 Mar 2021 09:51:48 +0800
+Subject: [PATCH] enable external linkmode for cgo build
+
+Signed-off-by: zhangsong234 <zhangsong34@huawei.com>
+---
+ Makefile | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index f305f96..c375f54 100644
+--- a/Makefile
++++ b/Makefile
+@@ -18,17 +18,12 @@ BEP_FLAGS=-tmpdir=/tmp/authz-build-bep
+ 
+ default: dep binary
+ 
+-GO_LDFLAGS = "-buildid=IdByiSula $(BEP_FLAGS) -buildmode=pie -extldflags=-static -extldflags=-Wl,-z,relro,-z,now -X main.version=$(VERSION)"
+-ifneq ($(GOPATH), )
+-CUS_GOPATH=${GOPATH}:${PWD}
+-ENV = GOPATH=${CUS_GOPATH} \
++GO_LDFLAGS = "-buildid=IdByiSula $(BEP_FLAGS) -buildmode=pie -linkmode=external -extldflags=-static -extldflags=-Wl,-z,relro,-z,now -X main.version=$(VERSION)"
++ENV = GOPATH=${GOPATH} \
+       CGO_ENABLED=1 \
+       CGO_CFLAGS="-fstack-protector-strong -fPIE" \
+       CGO_LDFLAGS_ALLOW='-Wl,-z,relro,-z,now' \
+       CGO_LDFLAGS="-Wl,-z,relro,-z,now -Wl,-z,noexecstack"
+-else
+-ENV = CGO_ENABLED=1
+-endif
+ 
+ dep:
+ 	mkdir -p $(BEP_DIR)
+-- 
+1.8.3.1
+
diff --git a/authz.spec b/authz.spec
index 7854b4cfeffe745ea14640ad3e176cfa72b17541..81323e3445bce256988b4a291dd73d2a8404afde 100644
--- a/authz.spec
+++ b/authz.spec
@@ -2,7 +2,7 @@
 
 Name:           authz
 Version:        0.1
-Release:        24
+Release:        25
 Summary:        a isula auth plugin for RBAC
 License:        Mulan PSL v2
 URL:            https://gitee.com/openeuler/authz
@@ -11,6 +11,7 @@ BuildRoot:      %{_tmppath}/authz-root
 
 Patch0001:      0001-authz-print-error-instead-of-panic-when-start-server.patch
 Patch0002:      0002-fix-safety-build.patch
+Patch0003:      0003-enable-external-linkmode-for-cgo-build.patch
 
 #Dependency
 BuildRequires: golang >= 1.8
@@ -24,6 +25,7 @@ Work with isulad daemon that enables TLS. It brings the support of RBAC.
 %setup -n %{name} -q
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 %build
 make
@@ -69,6 +71,9 @@ chmod 0640 /var/lib/authz-broker/policy.json
 rm -rfv %{buildroot}
 
 %changelog
+* Mon Mar 22 2021 zhangsong234 <zhangsong34@huawei.com> - 0.1-25
+- enable external linkmode for cgo build 
+
 * Fri Mar 19 2021 zhangsong234 <zhangsong34@huawei.com> - 0.1-24
 - fix safety build