commit - aec48c6cc2cd132e59d0286d87f2b3377d62eb93
commit + 7224234d05a484296e83f2c66dcfce87ab931cad
blob - 216f9c3eb81dab0bb0853b2b2ef04a1ef07da2d1
blob + 07a3f1b05cc3ad864f72395827453ad4d1a95538
--- got/got.c
+++ got/got.c
@@ -7947,6 +7947,12 @@ cmd_patch(int argc, char *argv[])
 	int ch, nop = 0, strip = -1, reverse = 0;
 	int patchfd;
 	int *pack_fds = NULL;
+
+#ifndef PROFILE
+	if (pledge("stdio rpath wpath cpath fattr proc exec sendfd flock "
+	    "unveil", NULL) == -1)
+		err(1, "pledge");
+#endif
 
 	while ((ch = getopt(argc, argv, "np:R")) != -1) {
 		switch (ch) {
@@ -8014,12 +8020,6 @@ cmd_patch(int argc, char *argv[])
 	    got_worktree_get_root_path(worktree));
 	if (error != NULL)
 		goto done;
-
-#ifndef PROFILE
-	if (pledge("stdio rpath wpath cpath fattr proc exec sendfd flock",
-	    NULL) == -1)
-		err(1, "pledge");
-#endif
 
 	error = got_patch(patchfd, worktree, repo, nop, strip, reverse,
 	    &patch_progress, NULL, check_cancelled, NULL);