diff --git a/sys/dev/disk/nata/ata-all.c b/sys/dev/disk/nata/ata-all.c
--- a/sys/dev/disk/nata/ata-all.c
+++ b/sys/dev/disk/nata/ata-all.c
@@ -32,6 +32,7 @@
 #include <sys/bus.h>
 #include <sys/callout.h>
 #include <sys/conf.h>
+#include <sys/caps.h>
 #include <sys/ctype.h>
 #include <sys/device.h>
 #include <sys/endian.h>
@@ -369,6 +370,10 @@
 static int
 ata_ioctl(struct dev_ioctl_args *ap)
 {
+	if (ap->a_cmd == IOCATAATTACH || ap->a_cmd == IOCATADETACH ||
+	    ap->a_cmd == IOCATAREINIT)
+		if (caps_priv_check(ap->a_cred, SYSCAP_RESTRICTEDROOT))
+			return EPERM;
     device_t device, *children;
     struct ata_ioc_devices *devices = (struct ata_ioc_devices *)ap->a_data;
     int *value = (int *)ap->a_data;