Index: lib/libutil/pidfile.c
===================================================================
--- lib/libutil/pidfile.c
+++ lib/libutil/pidfile.c
@@ -30,6 +30,7 @@
 #include <sys/param.h>
 #include <sys/file.h>
 #include <sys/stat.h>
+#include <sys/capsicum.h>
 
 #include <err.h>
 #include <errno.h>
@@ -103,6 +104,7 @@
 	struct stat sb;
 	int error, fd, dirfd, dirlen, filenamelen, count;
 	struct timespec rqtp;
+	cap_rights_t caprights;
 
 	pfh = malloc(sizeof(*pfh));
 	if (pfh == NULL)
@@ -179,13 +181,18 @@
 	 * to the proper descriptor.
 	 */
 	if (fstat(fd, &sb) == -1) {
-		error = errno;
-		unlinkat(dirfd, pfh->pf_filename, 0);
-		close(dirfd);
-		close(fd);
-		free(pfh);
-		errno = error;
-		return (NULL);
+		goto failed;
+	}
+
+	if (cap_rights_limit(dirfd,
+	    cap_rights_init(&caprights, CAP_UNLINKAT)) < 0 && errno != ENOSYS) {
+		goto failed;
+	}
+
+	if (cap_rights_limit(fd, cap_rights_init(&caprights, CAP_WRITE,
+	    CAP_FSTAT, CAP_FTRUNCATE, CAP_SEEK)) < 0 &&
+	    errno != ENOSYS) {
+		goto failed;
 	}
 
 	pfh->pf_dirfd = dirfd;
@@ -194,6 +201,15 @@
 	pfh->pf_ino = sb.st_ino;
 
 	return (pfh);
+
+failed:
+	error = errno;
+	unlinkat(dirfd, pfh->pf_filename, 0);
+	close(dirfd);
+	close(fd);
+	free(pfh);
+	errno = error;
+	return (NULL);
 }
 
 int