commit - 595228385f8c74590756ff446d5b84aad0ebfda7
commit + 2ed050c519e5d5706f53064a0e604533244ff969
blob - df883fd1dcb28651677ef268c491f878e506e7fe
blob + 3e86ff1ba0e1405d13dce902d5e91d684aef8bb7
--- got/got.c
+++ got/got.c
@@ -7947,6 +7947,12 @@ cmd_patch(int argc, char *argv[])
 	int ch, nop = 0, strip = -1, reverse = 0;
 	int patchfd;
 	int *pack_fds = NULL;
+
+#ifndef PROFILE
+	if (pledge("stdio rpath wpath cpath fattr proc exec sendfd flock "
+	    "unveil", NULL) == -1)
+		err(1, "pledge");
+#endif
 
 	while ((ch = getopt(argc, argv, "np:R")) != -1) {
 		switch (ch) {
@@ -8014,12 +8020,6 @@ cmd_patch(int argc, char *argv[])
 	    got_worktree_get_root_path(worktree));
 	if (error != NULL)
 		goto done;
-
-#ifndef PROFILE
-	if (pledge("stdio rpath wpath cpath fattr proc exec sendfd flock",
-	    NULL) == -1)
-		err(1, "pledge");
-#endif
 
 	error = got_patch(patchfd, worktree, repo, nop, strip, reverse,
 	    &patch_progress, NULL, check_cancelled, NULL);