diff --git a/lustre/mdd/mdd_permission.c b/lustre/mdd/mdd_permission.c
index f52d617..d9bb646 100644
--- a/lustre/mdd/mdd_permission.c
+++ b/lustre/mdd/mdd_permission.c
@@ -306,6 +306,9 @@ check_capabilities:
 		if (md_capable(uc, CFS_CAP_DAC_READ_SEARCH))
 			RETURN(0);
 
+	CERROR("permission denied, mode %x, fsuid %u, uid %u",
+	       la->la_mode, uc->uc_fsuid, la->la_uid);
+
 	RETURN(-EACCES);
 }
 
diff --git a/lustre/mdt/mdt_handler.c b/lustre/mdt/mdt_handler.c
index d16de29..9a0d62b 100644
--- a/lustre/mdt/mdt_handler.c
+++ b/lustre/mdt/mdt_handler.c
@@ -3921,7 +3921,7 @@ static int mdt_intent_getattr(enum mdt_it_code opcode,
                 GOTO(out_shrink, rc = -EINVAL);
         }
 
-        rc = mdt_init_ucred(info, reqbody);
+        rc = mdt_init_ucred_intent_getattr(info, reqbody);
         if (rc)
                 GOTO(out_shrink, rc);
 
diff --git a/lustre/mdt/mdt_internal.h b/lustre/mdt/mdt_internal.h
index 2f5c792..36ba68c 100644
--- a/lustre/mdt/mdt_internal.h
+++ b/lustre/mdt/mdt_internal.h
@@ -837,6 +837,7 @@ void mdt_dump_lmm(int level, const struct lov_mds_md *lmm, __u64 valid);
 
 int mdt_check_ucred(struct mdt_thread_info *);
 int mdt_init_ucred(struct mdt_thread_info *, struct mdt_body *);
+int mdt_init_ucred_intent_getattr(struct mdt_thread_info *, struct mdt_body *);
 int mdt_init_ucred_reint(struct mdt_thread_info *);
 void mdt_exit_ucred(struct mdt_thread_info *);
 int mdt_version_get_check(struct mdt_thread_info *, struct mdt_object *, int);
diff --git a/lustre/mdt/mdt_lib.c b/lustre/mdt/mdt_lib.c
index 09cee2c..2762c99 100644
--- a/lustre/mdt/mdt_lib.c
+++ b/lustre/mdt/mdt_lib.c
@@ -125,7 +125,7 @@ static int mdt_root_squash(struct mdt_thread_info *info, lnet_nid_t peernid)
 }
 
 static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
-                          void *buf)
+                          void *buf, bool drop_fs_cap)
 {
         struct ptlrpc_request   *req = mdt_info_req(info);
         struct mdt_device       *mdt = info->mti_mdt;
@@ -278,7 +278,7 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
 	mdt_root_squash(info, peernid);
 
 	/* remove fs privilege for non-root user. */
-	if (ucred->uc_fsuid)
+	if (ucred->uc_fsuid && drop_fs_cap)
 		ucred->uc_cap = pud->pud_cap & ~CFS_CAP_FS_MASK;
 	else
 		ucred->uc_cap = pud->pud_cap;
@@ -410,7 +410,7 @@ out:
 }
 
 static int old_init_ucred(struct mdt_thread_info *info,
-			  struct mdt_body *body)
+			  struct mdt_body *body, bool drop_fs_cap)
 {
 	struct lu_ucred *uc = mdt_ucred(info);
 	struct mdt_device  *mdt = info->mti_mdt;
@@ -446,7 +446,7 @@ static int old_init_ucred(struct mdt_thread_info *info,
 	mdt_root_squash(info, mdt_info_req(info)->rq_peer.nid);
 
 	/* remove fs privilege for non-root user. */
-	if (uc->uc_fsuid)
+	if (uc->uc_fsuid != 0 && drop_fs_cap)
 		uc->uc_cap = body->capability & ~CFS_CAP_FS_MASK;
 	else
 		uc->uc_cap = body->capability;
@@ -494,7 +494,9 @@ static int old_init_ucred_reint(struct mdt_thread_info *info)
 	RETURN(0);
 }
 
-int mdt_init_ucred(struct mdt_thread_info *info, struct mdt_body *body)
+static inline int __mdt_init_ucred(struct mdt_thread_info *info,
+				   struct mdt_body *body,
+				   bool drop_fs_cap)
 {
         struct ptlrpc_request *req = mdt_info_req(info);
 	struct lu_ucred       *uc  = mdt_ucred(info);
@@ -506,9 +508,20 @@ int mdt_init_ucred(struct mdt_thread_info *info, struct mdt_body *body)
         mdt_exit_ucred(info);
 
         if (!req->rq_auth_gss || req->rq_auth_usr_mdt || !req->rq_user_desc)
-                return old_init_ucred(info, body);
+                return old_init_ucred(info, body, drop_fs_cap);
         else
-                return new_init_ucred(info, BODY_INIT, body);
+                return new_init_ucred(info, BODY_INIT, body, drop_fs_cap);
+}
+
+int mdt_init_ucred(struct mdt_thread_info *info, struct mdt_body *body)
+{
+	return __mdt_init_ucred(info, body, true);
+}
+
+int mdt_init_ucred_intent_getattr(struct mdt_thread_info *info,
+				  struct mdt_body *body)
+{
+	return __mdt_init_ucred(info, body, false);
 }
 
 int mdt_init_ucred_reint(struct mdt_thread_info *info)
@@ -525,7 +538,7 @@ int mdt_init_ucred_reint(struct mdt_thread_info *info)
         if (!req->rq_auth_gss || req->rq_auth_usr_mdt || !req->rq_user_desc)
                 return old_init_ucred_reint(info);
         else
-                return new_init_ucred(info, REC_INIT, NULL);
+                return new_init_ucred(info, REC_INIT, NULL, true);
 }
 
 /* copied from lov/lov_ea.c, just for debugging, will be removed later */
