diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index 0f9961eede1e74021c43c4943b2bb419ed09a198..c9800b1a2e930f65e8fa7a9b052fb80efeba512c 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -95,6 +95,9 @@ static int create_encryption_context_from_policy(struct inode *inode,
 int fscrypt_process_policy(struct inode *inode,
 				const struct fscrypt_policy *policy)
 {
+	if (!inode_owner_or_capable(inode))
+		return -EACCES;
+
 	if (policy->version != 0)
 		return -EINVAL;