Index: usr.sbin/bhyve/audio.c
===================================================================
--- usr.sbin/bhyve/audio.c
+++ usr.sbin/bhyve/audio.c
@@ -28,10 +28,8 @@
  */
 
 #include <sys/cdefs.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
 #include <capsicum_helpers.h>
-#endif
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -70,7 +68,6 @@
 audio_init(const char *dev_name, uint8_t dir)
 {
 	struct audio *aud = NULL;
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
 	cap_ioctl_t cmds[] = {
 	    SNDCTL_DSP_RESET, SNDCTL_DSP_SETFMT, SNDCTL_DSP_CHANNELS,
@@ -79,7 +76,6 @@
 	    SNDCTL_DSP_GETOSPACE, SNDCTL_DSP_GETISPACE,
 #endif
 	};
-#endif
 
 	assert(dev_name);
 
@@ -105,13 +101,11 @@
 		return (NULL);
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(aud->fd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
 	if (caph_ioctls_limit(aud->fd, cmds, nitems(cmds)) == -1)
 		errx(EX_OSERR, "Unable to limit ioctl rights for sandbox");
-#endif
 
 	return aud;
 }
Index: usr.sbin/bhyve/bhyverun.c
===================================================================
--- usr.sbin/bhyve/bhyverun.c
+++ usr.sbin/bhyve/bhyverun.c
@@ -28,9 +28,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/types.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/mman.h>
 #ifdef BHYVE_SNAPSHOT
 #include <sys/socket.h>
@@ -43,9 +41,7 @@
 
 #include <machine/atomic.h>
 
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -601,10 +597,8 @@
 		exit(4);
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	if (vm_limit_rights(ctx) != 0)
 		err(EX_OSERR, "vm_limit_rights");
-#endif
 
 	if (reinit) {
 		error = vm_reinit(ctx);
@@ -1030,7 +1024,6 @@
 		errx(EX_OSERR, "Failed to start checkpoint thread");
 #endif
 
-#ifndef WITHOUT_CAPSICUM
 	caph_cache_catpages();
 
 	if (caph_limit_stdout() == -1 || caph_limit_stderr() == -1)
@@ -1038,7 +1031,6 @@
 
 	if (caph_enter() == -1)
 		errx(EX_OSERR, "cap_enter() failed");
-#endif
 
 #ifdef BHYVE_SNAPSHOT
 	if (restore_file != NULL) {
Index: usr.sbin/bhyve/block_if.c
===================================================================
--- usr.sbin/bhyve/block_if.c
+++ usr.sbin/bhyve/block_if.c
@@ -29,9 +29,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/queue.h>
 #include <sys/errno.h>
 #include <sys/stat.h>
@@ -39,9 +37,7 @@
 #include <sys/disk.h>
 
 #include <assert.h>
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <err.h>
 #include <fcntl.h>
 #include <stdio.h>
@@ -489,10 +485,8 @@
 	int nodelete;
 	int bootindex;
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
 	cap_ioctl_t cmds[] = { DIOCGFLUSH, DIOCGDELETE, DIOCGMEDIASIZE };
-#endif
 
 	pthread_once(&blockif_once, blockif_init);
 
@@ -562,7 +556,6 @@
 		goto err;
         }
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_FSYNC, CAP_IOCTL, CAP_READ, CAP_SEEK,
 	    CAP_WRITE, CAP_FSTAT, CAP_EVENT, CAP_FPATHCONF);
 	if (ro)
@@ -570,7 +563,6 @@
 
 	if (caph_rights_limit(fd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
         /*
 	 * Deal with raw devices
@@ -601,10 +593,8 @@
 		candelete = fpathconf(fd, _PC_DEALLOC_PRESENT) == 1;
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	if (caph_ioctls_limit(fd, cmds, nitems(cmds)) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	if (ssopt != 0) {
 		if (!powerof2(ssopt) || !powerof2(pssopt) || ssopt < 512 ||
Index: usr.sbin/bhyve/gdb.c
===================================================================
--- usr.sbin/bhyve/gdb.c
+++ usr.sbin/bhyve/gdb.c
@@ -27,9 +27,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/endian.h>
 #include <sys/ioctl.h>
 #include <sys/mman.h>
@@ -40,9 +38,7 @@
 #include <machine/vmm.h>
 #include <netinet/in.h>
 #include <assert.h>
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -202,13 +198,11 @@
 		logfile = fopen("/tmp/bhyve_gdb.log", "w");
 		if (logfile == NULL)
 			return;
-#ifndef WITHOUT_CAPSICUM
 		if (caph_limit_stream(fileno(logfile), CAPH_WRITE) == -1) {
 			fclose(logfile);
 			logfile = NULL;
 			return;
 		}
-#endif
 		setlinebuf(logfile);
 	}
 	va_start(ap, fmt);
@@ -1818,7 +1812,6 @@
 	pthread_mutex_unlock(&gdb_lock);
 }
 
-#ifndef WITHOUT_CAPSICUM
 static void
 limit_gdb_socket(int s)
 {
@@ -1832,7 +1825,6 @@
 	if (caph_ioctls_limit(s, ioctls, nitems(ioctls)) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
 }
-#endif
 
 void
 init_gdb(struct vmctx *_ctx)
@@ -1910,9 +1902,7 @@
 	if (fcntl(s, F_SETFL, flags | O_NONBLOCK) == -1)
 		err(1, "Failed to mark gdb socket non-blocking");
 
-#ifndef WITHOUT_CAPSICUM
 	limit_gdb_socket(s);
-#endif
 	mevent_add(s, EVF_READ, new_connection, NULL);
 	gdb_active = true;
 	freeaddrinfo(gdbaddr);
Index: usr.sbin/bhyve/mevent.c
===================================================================
--- usr.sbin/bhyve/mevent.c
+++ usr.sbin/bhyve/mevent.c
@@ -33,9 +33,7 @@
 
 #include <sys/cdefs.h>
 #include <assert.h>
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <err.h>
 #include <errno.h>
 #include <stdbool.h>
@@ -46,9 +44,7 @@
 #include <unistd.h>
 
 #include <sys/types.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/event.h>
 #include <sys/time.h>
 
@@ -126,18 +122,14 @@
 static void
 mevent_init(void)
 {
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	mfd = kqueue();
 	assert(mfd > 0);
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_KQUEUE);
 	if (caph_rights_limit(mfd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	LIST_INIT(&change_head);
 	LIST_INIT(&global_head);
@@ -486,9 +478,7 @@
 	struct mevent *pipev;
 	int numev;
 	int ret;
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	mevent_tid = pthread_self();
 	mevent_set_name();
@@ -506,13 +496,11 @@
 		exit(0);
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_EVENT, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(mevent_pipefd[0], &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
 	if (caph_rights_limit(mevent_pipefd[1], &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	/*
 	 * Add internal event handler for the pipe write fd
Index: usr.sbin/bhyve/net_backends.c
===================================================================
--- usr.sbin/bhyve/net_backends.c
+++ usr.sbin/bhyve/net_backends.c
@@ -34,9 +34,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/types.h>		/* u_short etc */
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/ioctl.h>
 #include <sys/mman.h>
 #include <sys/uio.h>
@@ -50,9 +48,7 @@
 #define NETMAP_WITH_LIBS
 #include <net/netmap_user.h>
 
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -227,9 +223,7 @@
 	struct ifreq ifrq;
 	int s;
 #endif
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	if (cb == NULL) {
 		WPRINTF(("TAP backend requires non-NULL callback"));
@@ -287,11 +281,9 @@
 	(void)close(s);
 #endif
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_EVENT, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(be->fd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	memset(priv->bbuf, 0, sizeof(priv->bbuf));
 	priv->bbuflen = 0;
@@ -459,9 +451,7 @@
 	int flags;
 	unsigned long maxsbsz;
 	size_t msbsz;
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	if (cb == NULL) {
 		WPRINTF(("Netgraph backend requires non-NULL callback"));
@@ -552,11 +542,9 @@
 		goto error;
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_EVENT, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(be->fd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	memset(p->bbuf, 0, sizeof(p->bbuf));
 	p->bbuflen = 0;
Index: usr.sbin/bhyve/pci_e82545.c
===================================================================
--- usr.sbin/bhyve/pci_e82545.c
+++ usr.sbin/bhyve/pci_e82545.c
@@ -31,9 +31,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/types.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/limits.h>
 #include <sys/ioctl.h>
 #include <sys/uio.h>
@@ -41,9 +39,7 @@
 #include <netinet/in.h>
 #include <netinet/tcp.h>
 
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 
 #include <err.h>
 #include <errno.h>
Index: usr.sbin/bhyve/pci_passthru.c
===================================================================
--- usr.sbin/bhyve/pci_passthru.c
+++ usr.sbin/bhyve/pci_passthru.c
@@ -28,9 +28,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/types.h>
 #include <sys/mman.h>
 #include <sys/pciio.h>
@@ -45,9 +43,7 @@
 #include <machine/iodev.h>
 #include <machine/vm.h>
 
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <ctype.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -129,7 +125,6 @@
 		return (1);
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t pcifd_rights;
 	cap_rights_init(&pcifd_rights, CAP_IOCTL, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(pcifd, &pcifd_rights) == -1)
@@ -139,7 +134,6 @@
 		PCIOCBARIO, PCIOCBARMMAP, PCIOCGETCONF };
 	if (caph_ioctls_limit(pcifd, pcifd_ioctls, nitems(pcifd_ioctls)) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	return (0);
 }
Index: usr.sbin/bhyve/pci_virtio_console.c
===================================================================
--- usr.sbin/bhyve/pci_virtio_console.c
+++ usr.sbin/bhyve/pci_virtio_console.c
@@ -32,18 +32,14 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/linker_set.h>
 #include <sys/uio.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/un.h>
 
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -277,9 +273,7 @@
 	char *cp, *pathcopy;
 	long port;
 	int s = -1, fd = -1, error = 0;
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	port = strtol(port_name, &cp, 0);
 	if (*cp != '\0' || port < 0 || port >= VTCON_MAXPORTS) {
@@ -341,11 +335,9 @@
 		goto out;
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(s, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	name = get_config_value_node(nvl, "name");
 	if (name == NULL) {
Index: usr.sbin/bhyve/pci_virtio_input.c
===================================================================
--- usr.sbin/bhyve/pci_virtio_input.c
+++ usr.sbin/bhyve/pci_virtio_input.c
@@ -33,11 +33,9 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
 
 #include <capsicum_helpers.h>
-#endif
 #include <sys/ioctl.h>
 #include <sys/linker_set.h>
 #include <sys/uio.h>
@@ -708,13 +706,11 @@
 		goto failed;
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
 	cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(sc->vsc_fd, &rights) == -1) {
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
 	}
-#endif
 
 	/* link virtio to softc */
 	vi_softc_linkup(
Index: usr.sbin/bhyve/pci_virtio_rnd.c
===================================================================
--- usr.sbin/bhyve/pci_virtio_rnd.c
+++ usr.sbin/bhyve/pci_virtio_rnd.c
@@ -35,15 +35,11 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/linker_set.h>
 #include <sys/uio.h>
 
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <err.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -144,9 +140,7 @@
 	int fd;
 	int len;
 	uint8_t v;
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	/*
 	 * Should always be able to open /dev/random.
@@ -155,11 +149,9 @@
 
 	assert(fd >= 0);
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_READ);
 	if (caph_rights_limit(fd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	/*
 	 * Check that device is seeded and non-blocking.
Index: usr.sbin/bhyve/rfb.c
===================================================================
--- usr.sbin/bhyve/rfb.c
+++ usr.sbin/bhyve/rfb.c
@@ -29,9 +29,7 @@
 
 #include <sys/cdefs.h>
 #include <sys/param.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/endian.h>
 #include <sys/socket.h>
 #include <sys/select.h>
@@ -44,9 +42,7 @@
 #include <netdb.h>
 
 #include <assert.h>
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <err.h>
 #include <errno.h>
 #include <pthread.h>
@@ -1142,9 +1138,7 @@
 	struct addrinfo hints;
 	int on = 1;
 	int cnt;
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	rc = calloc(1, sizeof(struct rfb_softc));
 
@@ -1195,11 +1189,9 @@
 		goto error;
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_ACCEPT, CAP_EVENT, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(rc->sfd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	rc->hw_crc = sse42_supported();
 
Index: usr.sbin/bhyve/snapshot.c
===================================================================
--- usr.sbin/bhyve/snapshot.c
+++ usr.sbin/bhyve/snapshot.c
@@ -35,18 +35,14 @@
 
 #include <sys/cdefs.h>
 #include <sys/types.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
-#endif
 #include <sys/mman.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/time.h>
 #include <sys/un.h>
 
-#ifndef WITHOUT_CAPSICUM
 #include <capsicum_helpers.h>
-#endif
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -65,9 +61,7 @@
 #include <sys/ioctl.h>
 
 #include <machine/vmm.h>
-#ifndef WITHOUT_CAPSICUM
 #include <machine/vmm_dev.h>
-#endif
 #include <machine/vmm_snapshot.h>
 #include <vmmapi.h>
 
@@ -1422,9 +1416,7 @@
 	int socket_fd;
 	pthread_t checkpoint_pthread;
 	int err;
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
-#endif
 
 	memset(&addr, 0, sizeof(addr));
 
@@ -1455,13 +1447,11 @@
 		goto fail;
 	}
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_ACCEPT, CAP_READ, CAP_RECV, CAP_WRITE,
 	    CAP_SEND, CAP_GETSOCKOPT);
 
 	if (caph_rights_limit(socket_fd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 	checkpoint_info = calloc(1, sizeof(*checkpoint_info));
 	checkpoint_info->ctx = ctx;
 	checkpoint_info->socket_fd = socket_fd;
Index: usr.sbin/bhyve/uart_emul.c
===================================================================
--- usr.sbin/bhyve/uart_emul.c
+++ usr.sbin/bhyve/uart_emul.c
@@ -30,10 +30,8 @@
 #include <sys/cdefs.h>
 #include <sys/types.h>
 #include <dev/ic/ns16550.h>
-#ifndef WITHOUT_CAPSICUM
 #include <sys/capsicum.h>
 #include <capsicum_helpers.h>
-#endif
 
 #include <machine/vmm_snapshot.h>
 
@@ -644,10 +642,8 @@
 static int
 uart_stdio_backend(struct uart_softc *sc)
 {
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
 	cap_ioctl_t cmds[] = { TIOCGETA, TIOCSETA, TIOCGWINSZ };
-#endif
 
 	if (uart_stdio)
 		return (-1);
@@ -661,13 +657,11 @@
 	if (fcntl(sc->tty.wfd, F_SETFL, O_NONBLOCK) != 0)
 		return (-1);
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ);
 	if (caph_rights_limit(sc->tty.rfd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
 	if (caph_ioctls_limit(sc->tty.rfd, cmds, nitems(cmds)) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	uart_stdio = true;
 
@@ -677,10 +671,8 @@
 static int
 uart_tty_backend(struct uart_softc *sc, const char *path)
 {
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_t rights;
 	cap_ioctl_t cmds[] = { TIOCGETA, TIOCSETA, TIOCGWINSZ };
-#endif
 	int fd;
 
 	fd = open(path, O_RDWR | O_NONBLOCK);
@@ -695,13 +687,11 @@
 	sc->tty.rfd = sc->tty.wfd = fd;
 	sc->tty.opened = true;
 
-#ifndef WITHOUT_CAPSICUM
 	cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ, CAP_WRITE);
 	if (caph_rights_limit(fd, &rights) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
 	if (caph_ioctls_limit(fd, cmds, nitems(cmds)) == -1)
 		errx(EX_OSERR, "Unable to apply rights for sandbox");
-#endif
 
 	return (0);
 }