diff --git a/sys/dev/disk/nvme/nvme_disk.c b/sys/dev/disk/nvme/nvme_disk.c
--- a/sys/dev/disk/nvme/nvme_disk.c
+++ b/sys/dev/disk/nvme/nvme_disk.c
@@ -33,6 +33,7 @@
  */
 
 #include "nvme.h"
+#include <sys/caps.h>		/* caps_priv_check_self() */
 
 static void nvme_disk_callback(nvme_request_t *req, struct lock *lk);
 static int nvme_strategy_core(nvme_softns_t *nsc, struct bio *bio, int delay);
@@ -160,8 +161,14 @@
 
 	switch(ap->a_cmd) {
 	case NVMEIOCGETLOG:
+	/* NVMEIOCGETLOG issues a controller-wide admin command (GET LOG PAGE)
+	 * reachable from a read-only fd on the namespace device.  Hardware-level
+	 * admin ioctls in other DragonFly drivers (cuse, ath, mpr) require root
+	 * via caps_priv_check_self(); require the same here.  See DF-2217. */
+	error = caps_priv_check_self(SYSCAP_NODRIVER);
+	if (error == 0)
 		error = nvme_getlog_ioctl(sc, (void *)ap->a_data);
-		break;
+	break;
 	default:
 		error = ENOIOCTL;
 		break;