diff --git a/source3/smbd/proto.h b/source3/smbd/proto.h
index 7926dd6d16d..be51182628e 100644
--- a/source3/smbd/proto.h
+++ b/source3/smbd/proto.h
@@ -1079,6 +1079,8 @@ int sys_statvfs(const char *path, vfs_statvfs_struct *statbuf);
 
 /* The following definitions come from smbd/trans2.c  */
 
+NTSTATUS check_access_fsp(const struct files_struct *fsp,
+			  uint32_t access_mask);
 NTSTATUS check_access(connection_struct *conn,
 				files_struct *fsp,
 				const struct smb_filename *smb_fname,
diff --git a/source3/smbd/trans2.c b/source3/smbd/trans2.c
index ec6d91bbd09..dd226ee1a65 100644
--- a/source3/smbd/trans2.c
+++ b/source3/smbd/trans2.c
@@ -54,6 +54,15 @@ static char *store_file_unix_basic_info2(connection_struct *conn,
 				files_struct *fsp,
 				const SMB_STRUCT_STAT *psbuf);
 
+NTSTATUS check_access_fsp(const struct files_struct *fsp,
+			  uint32_t access_mask)
+{
+	if (!(fsp->access_mask & access_mask)) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	return NT_STATUS_OK;
+}
+
 /********************************************************************
  The canonical "check access" based on object handle or path function.
 ********************************************************************/
@@ -64,10 +73,8 @@ NTSTATUS check_access(connection_struct *conn,
 				uint32_t access_mask)
 {
 	if (fsp) {
-		if (!(fsp->access_mask & access_mask)) {
-			return NT_STATUS_ACCESS_DENIED;
-		}
-		return NT_STATUS_OK;
+		NTSTATUS status = check_access_fsp(fsp, access_mask);
+		return status;
 	} else {
 		NTSTATUS status = smbd_check_access_rights(conn,
 					smb_fname,