diff --git a/usr.bin/sockstat/Makefile b/usr.bin/sockstat/Makefile
index a425216683e9..2127fab05692 100644
--- a/usr.bin/sockstat/Makefile
+++ b/usr.bin/sockstat/Makefile
@@ -1,8 +1,11 @@
-#	$NetBSD: Makefile,v 1.3.46.1 2019/08/19 16:01:52 martin Exp $
+#	$NetBSD: Makefile,v 1.6 2020/08/25 16:39:16 christos Exp $
 
 .include <bsd.own.mk>
 
 RUMPPRG=	sockstat
+BINGRP= kmem
+BINMODE=2555
+USE_FORT?= yes # setgid
 
 .PATH:  ${.CURDIR}/../../lib/libc/gen
 CPPFLAGS+= -DRUMP_ACTION
diff --git a/usr.bin/sockstat/sockstat.c b/usr.bin/sockstat/sockstat.c
index e5e9b5465adf..e0653b413ef0 100644
--- a/usr.bin/sockstat/sockstat.c
+++ b/usr.bin/sockstat/sockstat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sockstat.c,v 1.20.2.1 2019/08/19 16:01:52 martin Exp $ */
+/*	$NetBSD: sockstat.c,v 1.22 2020/08/25 14:05:17 christos Exp $ */
 
 /*
  * Copyright (c) 2005 The NetBSD Foundation, Inc.
@@ -179,6 +179,11 @@ main(int argc, char *argv[])
 	if (prog_init && prog_init() == -1)
 		err(1, "init");
 
+	/* Not used, but we set the PK_KMEM flag like this */
+	int fd = open("/dev/mem", O_RDONLY);
+	if (fd == -1)
+		err(EXIT_FAILURE, "Can't open `/dev/mem'");
+	close(fd);
 	if ((portmap != NULL) && (pf_list == 0)) {
 		pf_list = PF_LIST_INET;
 #ifdef INET6