commit - 6cd04c7054a96d0025d9a12fc17c8ffbc5085925
commit + 72cc612fc3a0ca437b8ae0c55ff815e9a1a9e766
blob - 4486b08390756e709d18c25cbfc370d75101ecc2
blob + e6a5360c8118db1b7ddda8cf4196d86f115c12ba
--- got/got.c
+++ got/got.c
@@ -1698,6 +1698,11 @@ cmd_clone(int argc, char *argv[])
 	if (error)
 		goto done;
 
+#ifndef PROFILE
+	if (pledge("stdio rpath wpath cpath fattr flock proc exec sendfd",
+	     NULL) == -1)
+		err(1, "pledge");
+#endif
 	if (!list_refs_only) {
 		error = got_repo_init(repo_path, NULL);
 		if (error)
@@ -2569,7 +2574,11 @@ cmd_fetch(int argc, char *argv[])
 	    server_path, verbosity);
 	if (error)
 		goto done;
-
+#ifndef PROFILE
+	if (pledge("stdio rpath wpath cpath fattr flock proc exec sendfd",
+	     NULL) == -1)
+		err(1, "pledge");
+#endif
 	if (!have_bflag) {
 		/*
 		 * If set, get this remote's HEAD ref target so