diff --git a/sys/kern/kern_event.c b/sys/kern/kern_event.c
--- a/sys/kern/kern_event.c
+++ b/sys/kern/kern_event.c
@@ -454,6 +454,9 @@
 	int error;
 	bool exiting, immediate;
 
+	if (IN_CAPABILITY_MODE(curthread))
+		return (ECAPMODE);
+
 	exiting = immediate = false;
 	if (kn->kn_sfflags & NOTE_EXIT)
 		p = pfind_any(kn->kn_id);
@@ -661,6 +664,9 @@
 {
 	struct prison *pr;
 
+	if (IN_CAPABILITY_MODE(curthread))
+		return (ECAPMODE);
+
 	if (kn->kn_id == 0) {
 		/* Let jid=0 watch the current prison (including prison0). */
 		pr = curthread->td_ucred->cr_prison;
diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c
--- a/sys/kern/vfs_subr.c
+++ b/sys/kern/vfs_subr.c
@@ -6563,6 +6563,8 @@
 static int
 filt_fsattach(struct knote *kn)
 {
+	if (IN_CAPABILITY_MODE(curthread))
+		return (ECAPMODE);
 
 	kn->kn_flags |= EV_CLEAR;
 	knlist_add(&fs_knlist, kn, 0);