diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index 25f62867a16d..a0d34dc05aa5 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -2216,8 +2216,12 @@ long seccomp_get_filter(struct task_struct *task, unsigned long filter_off,
 	struct seccomp_filter *filter;
 	struct sock_fprog_kern *fprog;
 	long ret;
+	struct user_namespace *user_ns = current_user_ns();
 
-	if (!capable(CAP_SYS_ADMIN) ||
+	if (task_cred_xxx(task, user_ns) == user_ns) {
+		if (!ns_capable(user_ns, CAP_SYS_ADMIN))
+			return -EACCES;
+	} else if (!capable(CAP_SYS_ADMIN) ||
 	    current->seccomp.mode != SECCOMP_MODE_DISABLED) {
 		return -EACCES;
 	}