diff --git a/kernel-src/fs/vfs.c b/kernel-src/fs/vfs.c
index 425b71e4..f302a77a 100644
--- a/kernel-src/fs/vfs.c
+++ b/kernel-src/fs/vfs.c
@@ -74,6 +74,13 @@ int vfs_mount(vnode_t *backing, vnode_t *pathref, char *path, char *name, void *
 	if (err)
 		return err;
 
+	err = auth_filesystem_check(getcred(), AUTH_ACTIONS_FILESYSTEM_MOUNT, mounton);
+
+	if (err) {
+		VOP_RELEASE(mounton);
+		return err;
+	}
+
 	if (mounton->type != V_TYPE_DIR) {
 		VOP_RELEASE(mounton);
 		return ENOTDIR;
diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h
index b3b4a66f..5bc3e0f1 100644
--- a/kernel-src/include/kernel/auth.h
+++ b/kernel-src/include/kernel/auth.h
@@ -21,6 +21,7 @@
 #define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
 #define AUTH_ACTIONS_FILESYSTEM_READ 	4
 #define AUTH_ACTIONS_FILESYSTEM_SETATTR 8
+#define AUTH_ACTIONS_FILESYSTEM_MOUNT 	16
 
 typedef int (*authlistener_t)(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2);
 
diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c
index d514767a..ac07d09e 100644
--- a/kernel-src/sys/defaultauth.c
+++ b/kernel-src/sys/defaultauth.c
@@ -71,6 +71,15 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
 		DONE_CHECK(actions);
 	}
 
+	if (actions & AUTH_ACTIONS_FILESYSTEM_MOUNT) {
+		// vnode is where it will be mounted on
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+	}
+
+
 	done:
 	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
 }
@@ -96,7 +105,6 @@ static int system(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2)
 		DONE_CHECK(actions);
 	}
 
-
 	done:
 	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
 }