Index: lib/libcapsicum/capsicum_helpers.h
===================================================================
--- lib/libcapsicum/capsicum_helpers.h
+++ lib/libcapsicum/capsicum_helpers.h
@@ -48,32 +48,42 @@
 
 __BEGIN_DECLS
 
-static __inline int
-caph_limit_stream(int fd, int flags)
+static const unsigned long caph_stream_cmds[] = \
+	{ TIOCGETA, TIOCGWINSZ, FIODTYPE };
+static const uint32_t caph_stream_fcntls = CAP_FCNTL_GETFL;
+
+static __inline void
+caph_stream_rights(cap_rights_t *rights, int flags)
 {
-	cap_rights_t rights;
-	unsigned long cmds[] = { TIOCGETA, TIOCGWINSZ, FIODTYPE };
 
-	cap_rights_init(&rights, CAP_EVENT, CAP_FCNTL, CAP_FSTAT,
+	cap_rights_init(rights, CAP_EVENT, CAP_FCNTL, CAP_FSTAT,
 	    CAP_IOCTL, CAP_SEEK);
 
 	if ((flags & CAPH_READ) != 0)
-		cap_rights_set(&rights, CAP_READ);
+		cap_rights_set(rights, CAP_READ);
 	if ((flags & CAPH_WRITE) != 0)
-		cap_rights_set(&rights, CAP_WRITE);
+		cap_rights_set(rights, CAP_WRITE);
 	if ((flags & CAPH_LOOKUP) != 0)
-		cap_rights_set(&rights, CAP_LOOKUP);
+		cap_rights_set(rights, CAP_LOOKUP);
+}
+
+static __inline int
+caph_limit_stream(int fd, int flags)
+{
+	cap_rights_t rights;
 
+	caph_stream_rights(&rights, flags);
 	if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) {
 		if (errno == EBADF && (flags & CAPH_IGNORE_EBADF) != 0)
 			return (0);
 		return (-1);
 	}
 
-	if (cap_ioctls_limit(fd, cmds, nitems(cmds)) < 0 && errno != ENOSYS)
+	if (cap_ioctls_limit(fd, caph_stream_cmds,
+	    nitems(caph_stream_cmds)) < 0 && errno != ENOSYS)
 		return (-1);
 
-	if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS)
+	if (cap_fcntls_limit(fd, caph_stream_fcntls) < 0 && errno != ENOSYS)
 		return (-1);
 
 	return (0);