diff --git a/kernel-src/include/kernel/auth.h b/kernel-src/include/kernel/auth.h
index 411ff2f3..b3b4a66f 100644
--- a/kernel-src/include/kernel/auth.h
+++ b/kernel-src/include/kernel/auth.h
@@ -15,6 +15,7 @@
 #define AUTH_DECISION_DENY -1000
 
 #define AUTH_ACTIONS_SYSTEM_CHROOT	1
+#define AUTH_ACTIONS_SYSTEM_SETHOSTNAME 2
 
 #define AUTH_ACTIONS_FILESYSTEM_EXECUTE 1
 #define AUTH_ACTIONS_FILESYSTEM_WRITE 	2
diff --git a/kernel-src/sys/defaultauth.c b/kernel-src/sys/defaultauth.c
index da82e26c..d514767a 100644
--- a/kernel-src/sys/defaultauth.c
+++ b/kernel-src/sys/defaultauth.c
@@ -87,6 +87,15 @@ static int system(cred_t *cred, int actions, void *arg0, void *arg1, void *arg2)
 		DONE_CHECK(actions);
 	}
 
+	if (actions & AUTH_ACTIONS_SYSTEM_SETHOSTNAME) {
+		if (CRED_IS_ESU(cred))
+			weight += 1;
+		else
+			return AUTH_DECISION_DENY;
+
+		DONE_CHECK(actions);
+	}
+
 
 	done:
 	return weight ? AUTH_DECISION_ALLOW : AUTH_DECISION_DEFER;
diff --git a/kernel-src/sys/syscalls/hostname.c b/kernel-src/sys/syscalls/hostname.c
index 53654c4e..8ab3f333 100644
--- a/kernel-src/sys/syscalls/hostname.c
+++ b/kernel-src/sys/syscalls/hostname.c
@@ -2,6 +2,7 @@
 #include <kernel/abi.h>
 #include <spinlock.h>
 #include <util.h>
+#include <kernel/auth.h>
 
 static spinlock_t lock;
 static char buffer[HOST_NAME_MAX];
@@ -32,6 +33,10 @@ syscallret_t syscall_hostname(context_t *, char *unew, size_t newsize, char *uol
 	char old[HOST_NAME_MAX + 1];
 
 	if (unew) {
+		ret.errno = auth_system_check(&_cpu()->thread->proc->cred, AUTH_ACTIONS_SYSTEM_SETHOSTNAME);
+		if (ret.errno)
+			return ret;
+
 		ret.errno = usercopy_fromuser(new, unew, newsize);
 		if (ret.errno)
 			return ret;