diff --git a/src/core/varlink-manager.c b/src/core/varlink-manager.c
index 997bdc08d0..6ae837376a 100644
--- a/src/core/varlink-manager.c
+++ b/src/core/varlink-manager.c
@@ -207,6 +207,10 @@ int vl_method_describe_manager(sd_varlink *link, sd_json_variant *parameters, sd
         if (r != 0)
                 return r;
 
+        r = mac_selinux_access_check_varlink(link, "status");
+        if (r < 0)
+                return r;
+
         r = sd_json_buildo(
                         &v,
                         SD_JSON_BUILD_PAIR_CALLBACK("context", manager_context_build_json, manager),
diff --git a/src/core/varlink-unit.c b/src/core/varlink-unit.c
index 2404c553d7..e8b86845a2 100644
--- a/src/core/varlink-unit.c
+++ b/src/core/varlink-unit.c
@@ -523,6 +523,10 @@ int vl_method_list_units(sd_varlink *link, sd_json_variant *parameters, sd_varli
                 if (k != unit->id)
                         continue;
 
+                r = mac_selinux_unit_access_check_varlink(unit, link, "status");
+                if (r < 0)
+                        continue; /* silently skip units the caller is not allowed to see */
+
                 r = list_unit_one(link, unit);
                 if (r < 0)
                         return r;