diff --git a/lustre/llite/dir.c b/lustre/llite/dir.c
index 01c73a4a83..8e2f9d7882 100644
--- a/lustre/llite/dir.c
+++ b/lustre/llite/dir.c
@@ -2011,6 +2011,30 @@ static long ll_dir_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		return -ENOTTY;
 
 	ll_stats_ops_tally(ll_i2sbi(inode), LPROC_LL_IOCTL, 1);
+
+	// perms for setstripe things
+	switch (cmd) {
+	case LL_IOC_LOV_SETSTRIPE_NEW:
+	case LL_IOC_LOV_SETSTRIPE:
+		if (sbi->ll_enable_setstripe_gid != -1 &&
+		    !capable(CAP_SYS_RESOURCE) &&
+		    /* in_group_p always returns true for gid == 0, so we check
+		     * for this case directly
+		     */
+		    (sbi->ll_enable_setstripe_gid == 0 ||
+		    !in_group_p(KGIDT_INIT(sbi->ll_enable_setstripe_gid)))) {
+			/* for lfs we return EACCES, so we can print an error
+			 * from the tool
+			 */
+			if (!strcmp(current->comm, "lfs"))
+				RETURN(-EACCES);
+			/* otherwise, setstripe is refused silently so
+			 * applications do not fail
+			 */
+			RETURN(0);
+		}
+	}
+
 	switch (cmd) {
 	case IOC_MDC_LOOKUP: {
 		int namelen, len = 0;
diff --git a/lustre/llite/file.c b/lustre/llite/file.c
index fdd0ebcecb..f85de55264 100644
--- a/lustre/llite/file.c
+++ b/lustre/llite/file.c
@@ -4711,6 +4711,31 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	if (_IOC_TYPE(cmd) == 'T' || _IOC_TYPE(cmd) == 't') /* tty ioctls */
 		RETURN(-ENOTTY);
 
+	// perms for setstripe things
+	switch (cmd) {
+	case LL_IOC_LOV_SETSTRIPE:
+	case LL_IOC_LOV_SETSTRIPE_NEW:
+	case LL_IOC_LOV_SETEA:
+	case LL_IOC_LOV_SWAP_LAYOUTS:
+		if (sbi->ll_enable_setstripe_gid != -1 &&
+		    !capable(CAP_SYS_RESOURCE) &&
+		    /* in_group_p always returns true for gid == 0, so we check
+		     * for this case directly
+		     */
+		    (sbi->ll_enable_setstripe_gid == 0 ||
+		     !in_group_p(KGIDT_INIT(sbi->ll_enable_setstripe_gid)))) {
+			/* for lfs we return EACCES, so we can print an error
+			 * from the tool
+			 */
+			if (!strcmp(current->comm, "lfs"))
+				RETURN(-EACCES);
+			/* otherwise, setstripe is refused silently so
+			 * applications do not fail
+			 */
+			RETURN(0);
+		}
+	}
+
 	/* can't do a generic karg == NULL check here, since it is too noisy and
 	 * we need to return -ENOTTY for unsupported ioctls instead of -EINVAL.
 	 */
@@ -4751,24 +4776,6 @@ ll_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	}
 	case LL_IOC_LOV_SETSTRIPE:
 	case LL_IOC_LOV_SETSTRIPE_NEW:
-		if (sbi->ll_enable_setstripe_gid != -1 &&
-		    !capable(CAP_SYS_RESOURCE) &&
-		    /* in_group_p always returns true for gid == 0, so we check
-		     * for this case directly
-		     */
-		    (sbi->ll_enable_setstripe_gid == 0 ||
-		     !in_group_p(KGIDT_INIT(sbi->ll_enable_setstripe_gid)))) {
-			/* for lfs we return EACCES, so we can print an error
-			 * from the tool
-			 */
-			if (!strcmp(current->comm, "lfs"))
-				RETURN(-EACCES);
-			/* otherwise, setstripe is refused silently so
-			 * applications do not fail
-			 */
-			RETURN(0);
-		}
-
 		RETURN(ll_lov_setstripe(inode, file, uarg));
 	case LL_IOC_LOV_SETEA:
 		RETURN(ll_lov_setea(inode, file, uarg));
diff --git a/lustre/llite/xattr.c b/lustre/llite/xattr.c
index 731c3f2ca2..9e3e5de631 100644
--- a/lustre/llite/xattr.c
+++ b/lustre/llite/xattr.c
@@ -414,6 +414,26 @@ static int ll_xattr_set(const struct xattr_handler *handler,
 
 	/* lustre/trusted.lov.xxx would be passed through xattr API */
 	if (!strcmp(name, "lov")) {
+		struct ll_sb_info *sbi = ll_i2sbi(inode);
+
+                if (sbi->ll_enable_setstripe_gid != -1 &&
+                    !capable(CAP_SYS_RESOURCE) &&
+                    /* in_group_p always returns true for gid == 0, so we check
+                     * for this case directly
+                     */
+                    (sbi->ll_enable_setstripe_gid == 0 ||
+                     !in_group_p(KGIDT_INIT(sbi->ll_enable_setstripe_gid)))) {
+                        /* for lfs we return EACCES, so we can print an error
+                         * from the tool
+                         */
+                        if (!strcmp(current->comm, "lfs"))
+                                RETURN(-EACCES);
+                        /* otherwise, setstripe is refused silently so
+                         * applications do not fail
+                         */
+                        RETURN(0);
+                }
+
 		rc = ll_setstripe_ea(dentry, (struct lov_user_md *)value,
 				       size);
 		ll_stats_ops_tally(ll_i2sbi(inode), op_type,