diff --git a/Lib/test/test_posix.py b/Lib/test/test_posix.py
index 98a39c3..4df882b 100644
--- a/Lib/test/test_posix.py
+++ b/Lib/test/test_posix.py
@@ -1476,6 +1476,8 @@
             os.pidfd_open(-1)
         if cm.exception.errno == errno.ENOSYS:
             self.skipTest("system does not support pidfd_open")
+        if isinstance(cm.exception, PermissionError):
+            self.skipTest(f"pidfd_open syscall blocked: {cm.exception!r}")
         self.assertEqual(cm.exception.errno, errno.EINVAL)
         os.close(os.pidfd_open(os.getpid(), 0))
 
diff --git a/Misc/NEWS.d/next/Tests/2019-11-20-15-42-06.bpo-38692.aqAvyF.rst b/Misc/NEWS.d/next/Tests/2019-11-20-15-42-06.bpo-38692.aqAvyF.rst
new file mode 100644
index 0000000..fa20566
--- /dev/null
+++ b/Misc/NEWS.d/next/Tests/2019-11-20-15-42-06.bpo-38692.aqAvyF.rst
@@ -0,0 +1,3 @@
+Skip the test_posix.test_pidfd_open() test if ``os.pidfd_open()`` fails with a
+:exc:`PermissionError`. This situation can happen in a Linux sandbox using a
+syscall whitelist which doesn't allow the ``pidfd_open()`` syscall yet.