diff --git a/kernel-src/fs/devfs.c b/kernel-src/fs/devfs.c
index a9ff7f8b..4f5ba889 100644
--- a/kernel-src/fs/devfs.c
+++ b/kernel-src/fs/devfs.c
@@ -202,12 +202,12 @@ int devfs_isatty(vnode_t *node) {
 	return devnode->devops->isatty ? devnode->devops->isatty(devnode->attr.rdevminor) : ENOTTY;
 }
 
-int devfs_ioctl(vnode_t *node, unsigned long request, void *arg, int *ret) {
+int devfs_ioctl(vnode_t *node, unsigned long request, void *arg, int *ret, cred_t *cred) {
 	devnode_t *devnode = (devnode_t *)node;
 	if (devnode->master)
 		devnode = devnode->master;
 
-	return devnode->devops->ioctl ? devnode->devops->ioctl(devnode->attr.rdevminor, request, arg, ret) : ENOTTY;
+	return devnode->devops->ioctl ? devnode->devops->ioctl(devnode->attr.rdevminor, request, arg, ret, cred) : ENOTTY;
 }
 
 int devfs_maxseek(vnode_t *node, size_t *max) {
diff --git a/kernel-src/fs/sockfs.c b/kernel-src/fs/sockfs.c
index 3b3cb082..80d22818 100644
--- a/kernel-src/fs/sockfs.c
+++ b/kernel-src/fs/sockfs.c
@@ -71,7 +71,7 @@ int sockfs_setattr(vnode_t *node, vattr_t *attr, int which, cred_t *cred) {
 }
 
 // arg can be in userspace
-int sockfs_ioctl(vnode_t *node, unsigned long request, void *arg, int *result) {
+int sockfs_ioctl(vnode_t *node, unsigned long request, void *arg, int *result, cred_t *cred) {
 	switch (request) {
 		case SIOCSIFADDR: {
 			ifreq_t ifreq;
@@ -80,7 +80,7 @@ int sockfs_ioctl(vnode_t *node, unsigned long request, void *arg, int *result) {
 				return e;
 
 			netdev_t *netdev = netdev_getdev(ifreq.name);
-			if(netdev) {
+			if (netdev) {
 				sockaddr_t sockaddr;
 				e = sock_convertaddress(&sockaddr, &ifreq.addr);
 				if (e)
diff --git a/kernel-src/fs/vfs.c b/kernel-src/fs/vfs.c
index 99df5cde..feeecd11 100644
--- a/kernel-src/fs/vfs.c
+++ b/kernel-src/fs/vfs.c
@@ -258,7 +258,7 @@ int vfs_write(vnode_t *node, void *buffer, size_t size, uintmax_t offset, size_t
 			// else just get the disk size and limit the read size
 			blockdesc_t blockdesc;
 			int r;
-			err = VOP_IOCTL(node, BLOCK_IOCTL_GETDESC, &blockdesc, &r);
+			err = VOP_IOCTL(node, BLOCK_IOCTL_GETDESC, &blockdesc, &r, NULL);
 			__assert(err == 0);
 
 			size_t bytesize = blockdesc.blockcapacity * blockdesc.blocksize;
@@ -352,7 +352,7 @@ int vfs_read(vnode_t *node, void *buffer, size_t size, uintmax_t offset, size_t
 		} else {
 			blockdesc_t blockdesc;
 			int r;
-			err = VOP_IOCTL(node, BLOCK_IOCTL_GETDESC, &blockdesc, &r);
+			err = VOP_IOCTL(node, BLOCK_IOCTL_GETDESC, &blockdesc, &r, NULL);
 			__assert(err == 0);
 
 			nodesize = blockdesc.blockcapacity * blockdesc.blocksize;
diff --git a/kernel-src/include/kernel/devfs.h b/kernel-src/include/kernel/devfs.h
index 2d6b65f4..14988a47 100644
--- a/kernel-src/include/kernel/devfs.h
+++ b/kernel-src/include/kernel/devfs.h
@@ -28,7 +28,7 @@ typedef struct {
 	int (*mmap)(int minor, void *addr, uintmax_t offset, int flags);
 	int (*munmap)(int minor, void *addr, uintmax_t offset, int flags);
 	int (*isatty)(int minor);
-	int (*ioctl)(int minor, unsigned long request, void *arg, int *result);
+	int (*ioctl)(int minor, unsigned long request, void *arg, int *result, cred_t *cred);
 	int (*maxseek)(int minor, size_t *max);
 	void (*inactive)(int minor);
 } devops_t;
diff --git a/kernel-src/include/kernel/tty.h b/kernel-src/include/kernel/tty.h
index 370a96ec..61fe6062 100644
--- a/kernel-src/include/kernel/tty.h
+++ b/kernel-src/include/kernel/tty.h
@@ -36,6 +36,6 @@ void tty_init();
 tty_t *tty_create(char *name, ttydevicewritefn_t writefn, ttyinactivefn_t inactivefn, void *internal);
 void tty_process(tty_t *tty, char c);
 void tty_unregister(tty_t *tty);
-int tty_ioctl(tty_t *tty, unsigned long req, void *arg, int *result);
+int tty_ioctl(tty_t *tty, unsigned long req, void *arg, int *result, cred_t *cred);
 
 #endif
diff --git a/kernel-src/include/kernel/vfs.h b/kernel-src/include/kernel/vfs.h
index 94316e97..7523fac4 100644
--- a/kernel-src/include/kernel/vfs.h
+++ b/kernel-src/include/kernel/vfs.h
@@ -135,7 +135,7 @@ typedef struct vops_t {
 	int (*munmap)(vnode_t *node, void *addr, uintmax_t offset, int flags, cred_t *cred);
 	int (*getdents)(vnode_t *node, dent_t *buffer, size_t count, uintmax_t offset, size_t *readcount);
 	int (*isatty)(vnode_t *node);
-	int (*ioctl)(vnode_t *node, unsigned long request, void *arg, int *result);
+	int (*ioctl)(vnode_t *node, unsigned long request, void *arg, int *result, cred_t *cred);
 	int (*maxseek)(vnode_t *node, size_t *max);
 	int (*resize)(vnode_t *node, size_t newsize, cred_t *cred);
 	int (*rename)(vnode_t *sourcedir, vnode_t *source, char *oldname, vnode_t *targetdir, vnode_t *target, char *newname, int flags);
@@ -189,7 +189,7 @@ typedef struct vops_t {
 #define VOP_GETDENTS(v, b, c, o, rc) (v)->ops->getdents(v, b, c, o, rc)
 #define VOP_POLL(v, d, p) (v)->ops->poll(v, d, p)
 #define VOP_ISATTY(v) ((v)->ops->isatty ? (v)->ops->isatty(v) : ENOTTY)
-#define VOP_IOCTL(v, r, a, rp) ((v)->ops->ioctl ? (v)->ops->ioctl(v, r, a, rp) : ENOTTY)
+#define VOP_IOCTL(v, r, a, rp, c) ((v)->ops->ioctl ? (v)->ops->ioctl(v, r, a, rp, c) : ENOTTY)
 #define VOP_MAXSEEK(v, rp) ((v)->ops->maxseek ? (v)->ops->maxseek(v, rp) : ENOTTY)
 #define VOP_RESIZE(v, s, c) (v)->ops->resize(v, s, c)
 #define VOP_RENAME(sd, s, o, td, t, n, f) (s)->ops->rename(sd, s, o, td, t, n, f)
diff --git a/kernel-src/io/block/block.c b/kernel-src/io/block/block.c
index 5f1e9d11..41408ff9 100644
--- a/kernel-src/io/block/block.c
+++ b/kernel-src/io/block/block.c
@@ -132,7 +132,7 @@ static int write(int minor, void *buffer, size_t size, uintmax_t offset, int fla
 	return rwblock(minor, buffer, size, offset, flags, true, writec);
 }
 
-static int ioctl(int minor, unsigned long request, void *arg, int *result) {
+static int ioctl(int minor, unsigned long request, void *arg, int *result, cred_t *cred) {
 	blockdesc_t *desc = getdesc(minor);
 	if (desc == NULL)
 		return ENODEV;
diff --git a/kernel-src/io/fb.c b/kernel-src/io/fb.c
index 8d823652..ee0bc4e1 100644
--- a/kernel-src/io/fb.c
+++ b/kernel-src/io/fb.c
@@ -169,7 +169,7 @@ static int munmap(int minor, void *addr, uintmax_t offset, int flags) {
 #define FBIOGET_FSCREENINFO	0x4602
 #define FBIOBLANK		0x4611
 
-static int ioctl(int minor, unsigned long request, void *arg, int *result){
+static int ioctl(int minor, unsigned long request, void *arg, int *result, cred_t *cred){
         if (minor >= count)
                 return ENODEV;
 
diff --git a/kernel-src/io/pty.c b/kernel-src/io/pty.c
index 34d8919a..2494df39 100644
--- a/kernel-src/io/pty.c
+++ b/kernel-src/io/pty.c
@@ -192,7 +192,7 @@ static int poll(int minor, polldata_t *data, int events) {
 	return revents;
 }
 #define TIOCGPTN 0x80045430
-static int ioctl(int minor, unsigned long request, void *_arg, int *result) {
+static int ioctl(int minor, unsigned long request, void *_arg, int *result, cred_t *cred) {
 	pty_t *pty = ptyget(minor);
 	if (pty == NULL)
 		return ENODEV;
@@ -202,7 +202,7 @@ static int ioctl(int minor, unsigned long request, void *_arg, int *result) {
 			return USERCOPY_POSSIBLY_TO_USER(_arg, &pty->minor, sizeof(int));
 		}
 		default:
-			return tty_ioctl(pty->tty, request, _arg, result);
+			return tty_ioctl(pty->tty, request, _arg, result, cred);
 	}
 
 	return 0;
diff --git a/kernel-src/io/tty.c b/kernel-src/io/tty.c
index 953409fc..3c4a4438 100644
--- a/kernel-src/io/tty.c
+++ b/kernel-src/io/tty.c
@@ -299,7 +299,7 @@ static int poll(int minor, polldata_t *data, int events) {
 #define TTY_IOCTL_NAME 0x771101141113l
 #define TTY_NAME_MAX 32
 
-int tty_ioctl(tty_t *tty, unsigned long req, void *arg, int *result) {
+int tty_ioctl(tty_t *tty, unsigned long req, void *arg, int *result, cred_t *cred) {
 	switch (req) {
 		case TIOCGWINSZ:
 			return USERCOPY_POSSIBLY_TO_USER(arg, &tty->winsize, sizeof(winsize_t));
@@ -359,12 +359,12 @@ int tty_ioctl(tty_t *tty, unsigned long req, void *arg, int *result) {
 	return 0;
 }
 
-static int ioctl(int minor, unsigned long req, void *arg, int *result) {
+static int ioctl(int minor, unsigned long req, void *arg, int *result, cred_t *cred) {
 	tty_t *tty = ttyget(minor);
 	if (tty == NULL)
 		return ENODEV;
 
-	return tty_ioctl(tty, req, arg, result);
+	return tty_ioctl(tty, req, arg, result, cred);
 }
 
 static int isatty(int minor) {
diff --git a/kernel-src/sys/syscalls/ioctl.c b/kernel-src/sys/syscalls/ioctl.c
index 462ff0d8..4609b467 100644
--- a/kernel-src/sys/syscalls/ioctl.c
+++ b/kernel-src/sys/syscalls/ioctl.c
@@ -20,7 +20,7 @@ syscallret_t syscall_ioctl(context_t *, int fd, unsigned long request, void *arg
 
 	int r = 0;
 	VOP_LOCK(file->vnode);
-	ret.errno = VOP_IOCTL(file->vnode, request, arg, &r);
+	ret.errno = VOP_IOCTL(file->vnode, request, arg, &r, &_cpu()->thread->proc->cred);
 	VOP_UNLOCK(file->vnode);
 	ret.ret = ret.errno ? -1 : r;