diff --git a/autotest.sh b/autotest.sh
index 9bff44e95..a58cd524b 100755
--- a/autotest.sh
+++ b/autotest.sh
@@ -60,8 +60,6 @@ src=$(readlink -f $(dirname $0))
 out=$output_dir
 cd $src
 
-./scripts/setup.sh status
-
 freebsd_update_contigmem_mod
 
 # lcov takes considerable time to process clang coverage.
@@ -127,8 +125,11 @@ if [ $(uname -s) = Linux ]; then
 		# Export our blocked list so it will take effect during next setup.sh
 		export PCI_BLOCKED
 	fi
+	run_test "setup.sh" "$rootdir/test/setup/test-setup.sh"
 fi
 
+./scripts/setup.sh status
+
 if [[ $(uname -s) == Linux ]]; then
 	# Revert NVMe namespaces to default state
 	nvme_namespace_revert
diff --git a/test/setup/acl.sh b/test/setup/acl.sh
new file mode 100755
index 000000000..4c3b9bc22
--- /dev/null
+++ b/test/setup/acl.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+testdir=$(readlink -f "$(dirname "$0")")
+rootdir=$(readlink -f "$testdir/../../")
+source "$testdir/common.sh"
+
+declare -a devs=()
+declare -A drivers=()
+
+collect_setup_devs() {
+	local dev driver
+
+	while read -r _ dev _ _ _ driver _; do
+		[[ $dev == *:*:*.* ]] || continue
+		devs+=("$dev") drivers["$dev"]=$driver
+	done < <(setup output status)
+	((${#devs[@]} > 0))
+}
+
+verify() {
+	local dev driver
+
+	for dev; do
+		[[ -e /sys/bus/pci/devices/$dev ]]
+		driver=$(readlink -f "/sys/bus/pci/devices/$dev/driver")
+		[[ ${drivers["$dev"]} == "${driver##*/}" ]]
+	done
+}
+
+denied() {
+	# Include OCSSD devices in the PCI_BLOCKED to make sure we don't unbind
+	# them from the pci-stub (see autotest.sh for details).
+	PCI_BLOCKED="$OCSSD_PCI_DEVICES ${devs[0]}" setup output config \
+		| grep "Skipping denied controller at ${devs[0]}"
+	verify "${devs[0]}"
+	setup reset
+}
+
+allowed() {
+	PCI_ALLOWED="${devs[0]}" setup output config \
+		| grep "Skipping denied controller at " \
+		| grep -v "${devs[0]}"
+	verify "${devs[@]:1}"
+	setup reset
+}
+
+setup reset
+collect_setup_devs
+
+run_test "denied" denied
+run_test "allowed" allowed
diff --git a/test/setup/common.sh b/test/setup/common.sh
new file mode 100644
index 000000000..d7913e802
--- /dev/null
+++ b/test/setup/common.sh
@@ -0,0 +1,9 @@
+source "$rootdir/test/common/autotest_common.sh"
+
+setup() {
+	if [[ $1 == output ]]; then
+		"$rootdir/scripts/setup.sh" "${@:2}"
+	else
+		"$rootdir/scripts/setup.sh" "$@" &> /dev/null
+	fi
+}
diff --git a/test/setup/test-setup.sh b/test/setup/test-setup.sh
new file mode 100755
index 000000000..e5a09c80f
--- /dev/null
+++ b/test/setup/test-setup.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+testdir=$(readlink -f "$(dirname "$0")")
+rootdir=$(readlink -f "$testdir/../../")
+source "$testdir/common.sh"
+
+[[ $(uname -s) == Linux ]] || exit 0
+
+run_test "acl" "$testdir/acl.sh"