diff --git a/sys/security/mac_veriexec/mac_veriexec.c b/sys/security/mac_veriexec/mac_veriexec.c
index 7a5b747ef7a..99a76abd4af 100644
--- a/sys/security/mac_veriexec/mac_veriexec.c
+++ b/sys/security/mac_veriexec/mac_veriexec.c
@@ -437,7 +437,7 @@ mac_veriexec_sysctl_check(struct ucred *cred, struct sysctl_oid *oidp,
 		return (0);
 
 	oid = oidp;
-	if (oid->oid_kind & CTLFLAG_SECURE) {
+	if (req->newptr && (oid->oid_kind & CTLFLAG_SECURE)) {
 		return (EPERM);		/* XXX call mac_veriexec_priv_check? */
 	}
 	return 0;