Index: sys/fs/nfsserver/nfs_nfsdport.c
===================================================================
--- sys/fs/nfsserver/nfs_nfsdport.c
+++ sys/fs/nfsserver/nfs_nfsdport.c
@@ -349,7 +349,7 @@
 
 	*retdirp = NULL;
 	cnp->cn_nameptr = cnp->cn_pnbuf;
-	ndp->ni_strictrelative = 0;
+	ndp->ni_nonrelativeerrno = 0;
 	/*
 	 * Extract and set starting directory.
 	 */
Index: sys/kern/vfs_lookup.c
===================================================================
--- sys/kern/vfs_lookup.c
+++ sys/kern/vfs_lookup.c
@@ -115,12 +115,12 @@
 	struct componentname *cnp;
 
 	cnp = &ndp->ni_cnd;
-	if (ndp->ni_strictrelative != 0) {
+	if (ndp->ni_nonrelativeerrno != 0) {
 #ifdef KTRACE
 		if (KTRPOINT(curthread, KTR_CAPFAIL))
 			ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL);
 #endif
-		return (ENOTCAPABLE);
+		return (ndp->ni_nonrelativeerrno);
 	}
 	while (*(cnp->cn_nameptr) == '/') {
 		cnp->cn_nameptr++;
@@ -206,7 +206,8 @@
 	 */
 	if (error == 0 && IN_CAPABILITY_MODE(td) &&
 	    (cnp->cn_flags & NOCAPCHECK) == 0) {
-		ndp->ni_strictrelative = 1;
+		if (ndp->ni_nonrelativeerrno != EPERM)
+			ndp->ni_nonrelativeerrno = ENOTCAPABLE;
 		if (ndp->ni_dirfd == AT_FDCWD) {
 #ifdef KTRACE
 			if (KTRPOINT(td, KTR_CAPFAIL))
@@ -274,14 +275,17 @@
 			 * If file descriptor doesn't have all rights,
 			 * all lookups relative to it must also be
 			 * strictly relative.
+			 *
+			 * Don't overwrite a value of EPERM, however:
+			 * we need to honour a user O_BENEATH request.
 			 */
 			CAP_ALL(&rights);
-			if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights,
-			    &rights) ||
-			    ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL ||
-			    ndp->ni_filecaps.fc_nioctls != -1) {
-				ndp->ni_strictrelative = 1;
-			}
+			if ((!cap_rights_contains(&ndp->ni_filecaps.fc_rights,
+			      &rights) ||
+			      ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL ||
+			      ndp->ni_filecaps.fc_nioctls != -1) &&
+			    ndp->ni_nonrelativeerrno != EPERM)
+				ndp->ni_nonrelativeerrno = ENOTCAPABLE;
 #endif
 		}
 		if (error == 0 && dp->v_type != VDIR)
@@ -642,12 +646,21 @@
 	 *    the jail or chroot, don't let them out.
 	 */
 	if (cnp->cn_flags & ISDOTDOT) {
-		if (ndp->ni_strictrelative != 0) {
 #ifdef KTRACE
+		switch (ndp->ni_nonrelativeerrno) {
+		case EPERM:
+			if (KTRPOINT(curthread, KTR_NAMEI))
+				ktrnamei(cnp->cn_nameptr);
+			break;
+
+		case ENOTCAPABLE:
 			if (KTRPOINT(curthread, KTR_CAPFAIL))
 				ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL);
+			break;
+		}
 #endif
-			error = ENOTCAPABLE;
+		if (ndp->ni_nonrelativeerrno != 0) {
+			error = ndp->ni_nonrelativeerrno;
 			goto bad;
 		}
 		if ((cnp->cn_flags & ISLASTCN) != 0 &&
@@ -1082,7 +1095,7 @@
 	ndp->ni_dirp = namep;
 	ndp->ni_dirfd = dirfd;
 	ndp->ni_startdir = startdir;
-	ndp->ni_strictrelative = 0;
+	ndp->ni_nonrelativeerrno = 0;
 	if (rightsp != NULL)
 		ndp->ni_rightsneeded = *rightsp;
 	else
Index: sys/kern/vfs_syscalls.c
===================================================================
--- sys/kern/vfs_syscalls.c
+++ sys/kern/vfs_syscalls.c
@@ -959,7 +959,7 @@
 	struct vnode *vp;
 	struct nameidata nd;
 	cap_rights_t rights;
-	int cmode, error, indx;
+	int beneath, cmode, error, indx;
 
 	indx = -1;
 
@@ -968,6 +968,7 @@
 	/* XXX: audit dirfd */
 	cap_rights_init(&rights, CAP_LOOKUP);
 	flags_to_rights(flags, &rights);
+	beneath = ((flags & O_BENEATH) == O_BENEATH);
 	/*
 	 * Only one of the O_EXEC, O_RDONLY, O_WRONLY and O_RDWR flags
 	 * may be specified.
@@ -996,6 +997,8 @@
 	cmode = ((mode & ~fdp->fd_cmask) & ALLPERMS) & ~S_ISTXT;
 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | AUDITVNODE1, pathseg, path, fd,
 	    &rights, td);
+	if (beneath)
+		nd.ni_nonrelativeerrno = EPERM;
 	td->td_dupfd = -1;		/* XXX check for fdopen */
 	error = vn_open(&nd, &flags, cmode, fp);
 	if (error != 0) {
@@ -1010,11 +1013,13 @@
 		/*
 		 * Handle special fdopen() case. bleh.
 		 *
-		 * Don't do this for relative (capability) lookups; we don't
+		 * Don't do this for capability or O_BENEATH lookups: we don't
 		 * understand exactly what would happen, and we don't think
 		 * that it ever should.
+		 *
+		 * XXXJA: can fdopen() ever be called with O_BENEATH?
 		 */
-		if (nd.ni_strictrelative == 0 &&
+		if (nd.ni_nonrelativeerrno == 0 &&
 		    (error == ENODEV || error == ENXIO) &&
 		    td->td_dupfd >= 0) {
 			error = dupfdopen(td, fdp, td->td_dupfd, flags, error,
@@ -1060,7 +1065,8 @@
 		struct filecaps *fcaps;
 
 #ifdef CAPABILITIES
-		if (nd.ni_strictrelative == 1)
+		if (nd.ni_nonrelativeerrno != 0 &&
+		    cap_rights_is_valid(&nd.ni_filecaps.fc_rights))
 			fcaps = &nd.ni_filecaps;
 		else
 #endif
Index: sys/sys/fcntl.h
===================================================================
--- sys/sys/fcntl.h
+++ sys/sys/fcntl.h
@@ -131,6 +131,7 @@
 
 #if __BSD_VISIBLE
 #define	O_VERIFY	0x00200000	/* open only after verification */
+#define	O_BENEATH	0x00400000	/* stay beneath a specified directory */
 #endif
 
 /*
Index: sys/sys/namei.h
===================================================================
--- sys/sys/namei.h
+++ sys/sys/namei.h
@@ -73,7 +73,7 @@
 	struct	vnode *ni_rootdir;	/* logical root directory */
 	struct	vnode *ni_topdir;	/* logical top directory */
 	int	ni_dirfd;		/* starting directory for *at functions */
-	int	ni_strictrelative;	/* relative lookup only; no '..' */
+	int	ni_nonrelativeerrno;	/* errno for non-relative (..) lookup */
 	/*
 	 * Results: returned from namei
 	 */