diff --git a/dix/devices.c b/dix/devices.c
index b6cb4a5c0..3395cd33d 100644
--- a/dix/devices.c
+++ b/dix/devices.c
@@ -119,7 +119,6 @@ AddInputDevice(DeviceProc deviceProc, Bool autoStart)
     dev->name = (char *)NULL;
     dev->type = 0;
     dev->id = devid;
-    inputInfo.numDevices++;
     dev->public.on = FALSE;
     dev->public.processInputProc = (ProcessInputProc)NoopDDA;
     dev->public.realInputProc = (ProcessInputProc)NoopDDA;
@@ -156,6 +155,15 @@ AddInputDevice(DeviceProc deviceProc, Bool autoStart)
     dev->inited = FALSE;
     dev->enabled = FALSE;
 
+    /*  security creation/labeling check
+     */
+    if (XaceHook(XACE_DEVICE_ACCESS, serverClient, dev, DixCreateAccess)) {
+	xfree(dev);
+	return NULL;
+    }
+
+    inputInfo.numDevices++;
+
     for (prev = &inputInfo.off_devices; *prev; prev = &(*prev)->next)
         ;
     *prev = dev;