Index: sys/kern/subr_capability.c
===================================================================
--- sys/kern/subr_capability.c
+++ sys/kern/subr_capability.c
@@ -248,6 +248,7 @@
 	return (true);
 }
 
+#ifdef _KERNEL
 void
 __cap_rights_sysinit(void *arg)
 {
@@ -257,6 +258,7 @@
 	__cap_rights_init(CAP_RIGHTS_VERSION, rights, cria->cria_value1,
        cria->cria_value2, cria->cria_value3, cria->cria_value4, 0ULL);
 }
+#endif
 
 cap_rights_t *
 __cap_rights_init(int version, cap_rights_t *rights, ...)
Index: sys/sys/capsicum.h
===================================================================
--- sys/sys/capsicum.h
+++ sys/sys/capsicum.h
@@ -342,9 +342,10 @@
 bool cap_rights_is_valid(const cap_rights_t *rights);
 cap_rights_t *cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src);
 cap_rights_t *cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src);
-void __cap_rights_sysinit(void *arg);
 
 #ifdef _KERNEL
+void __cap_rights_sysinit(void *arg);
+
 /*
  * We only support one size to reduce branching.
  */
@@ -416,6 +417,10 @@
 #endif
 
 __END_DECLS
+
+#ifdef _KERNEL
+
+#include <sys/systm.h>
 struct cap_rights_init_args {
 	cap_rights_t *cria_rights;
 	uint64_t cria_value1;
@@ -474,9 +479,6 @@
 	__read_mostly cap_rights_t name;					\
 	CAP_RIGHTS_SYSINIT1(name, name, value);
 
-#ifdef _KERNEL
-
-#include <sys/systm.h>
 extern cap_rights_t cap_accept_rights;
 extern cap_rights_t cap_bind_rights;
 extern cap_rights_t cap_connect_rights;