diff --git a/src/tools/kata-ctl/Cargo.toml b/src/tools/kata-ctl/Cargo.toml
index 094613c343..a6701ddbd0 100644
--- a/src/tools/kata-ctl/Cargo.toml
+++ b/src/tools/kata-ctl/Cargo.toml
@@ -15,6 +15,8 @@ clap = { version = "3.2.20", features = ["derive", "cargo"] }
 reqwest = { version = "0.11", default-features = false, features = ["json", "blocking", "rustls-tls"] }
 serde_json = "1.0.85"
 thiserror = "1.0.35"
+privdrop = "0.5.2"
+nix = "0.25.0"
 
 [dev-dependencies]
 semver = "1.0.12"
diff --git a/src/tools/kata-ctl/src/main.rs b/src/tools/kata-ctl/src/main.rs
index 30e4b5eb7a..df3e0d7e7a 100644
--- a/src/tools/kata-ctl/src/main.rs
+++ b/src/tools/kata-ctl/src/main.rs
@@ -7,6 +7,7 @@ mod arch;
 mod args;
 mod check;
 mod ops;
+mod utils;
 
 use anyhow::Result;
 use clap::Parser;
diff --git a/src/tools/kata-ctl/src/utils.rs b/src/tools/kata-ctl/src/utils.rs
new file mode 100644
index 0000000000..86b22a4bf0
--- /dev/null
+++ b/src/tools/kata-ctl/src/utils.rs
@@ -0,0 +1,33 @@
+// Copyright (c) 2022 Intel Corporation
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+#![allow(dead_code)]
+
+use anyhow::{anyhow, Result};
+
+const NON_PRIV_USER: &str = "nobody";
+
+pub fn drop_privs() -> Result<()> {
+    if nix::unistd::Uid::effective().is_root() {
+        privdrop::PrivDrop::default()
+            .chroot("/")
+            .user(NON_PRIV_USER)
+            .apply()
+            .map_err(|e| anyhow!("Failed to drop privileges to user {}: {}", NON_PRIV_USER, e))?;
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_drop_privs() {
+        let res = drop_privs();
+        assert!(res.is_ok());
+    }
+}