diff --git a/kernel-src/fs/vfs.c b/kernel-src/fs/vfs.c
index d26425b7..93be8d65 100644
--- a/kernel-src/fs/vfs.c
+++ b/kernel-src/fs/vfs.c
@@ -337,6 +337,12 @@ int vfs_create(vnode_t *ref, char *path, vattr_t *attr, int type, vnode_t **node
 		goto cleanup_parent;
 	}
 
+	if (type == V_TYPE_CHDEV || type == V_TYPE_BLKDEV) {
+		err = auth_filesystem_check(getcred(), AUTH_ACTIONS_FILESYSTEM_MKNOD, parent, NULL);
+		if (err)
+			goto cleanup_parent;
+	}
+
 	vnode_t *ret;
 	err = VOP_CREATE(parent, component, attr, type, &ret, getcred());
 	if (err)
diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h
index 305c9a97..8e1e2006 100644
--- a/kernel-src/include/kernel/auth.h
+++ b/kernel-src/include/kernel/auth.h
@@ -29,6 +29,7 @@
 #define AUTH_ACTIONS_FILESYSTEM_MOUNT 	16
 #define AUTH_ACTIONS_FILESYSTEM_UNLINK	32
 #define AUTH_ACTIONS_FILESYSTEM_RENAME	64
+#define AUTH_ACTIONS_FILESYSTEM_MKNOD	128
 
 #define AUTH_ACTIONS_CRED_SETRESUID	1
 #define AUTH_ACTIONS_CRED_SETRESGID	2
diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c
index c9664610..82af47ac 100644
--- a/kernel-src/sys/defaultauth.c
+++ b/kernel-src/sys/defaultauth.c
@@ -94,6 +94,15 @@ static int filesystem(cred_t *cred, int actions, void *arg0, void *arg1, void *a
 		DONE_CHECK(actions);
 	}
 
+	if (actions & AUTH_ACTIONS_FILESYSTEM_MKNOD) {
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
 	if (actions & (AUTH_ACTIONS_FILESYSTEM_UNLINK | AUTH_ACTIONS_FILESYSTEM_RENAME)) {
 		__assert(dirvnode);