Index: kernel/generic/src/ipc/ipcrsc.c
===================================================================
--- kernel/generic/src/ipc/ipcrsc.c	(revision 50dd8544f601ebd5a6afcaa9c1a1b0dadbe951be)
+++ kernel/generic/src/ipc/ipcrsc.c	(revision 334c103bd742e45dfad5702649323deed1a18dbe)
@@ -150,11 +150,13 @@
 /** Allocate new phone in the specified task.
  *
- * @param task  Task for which to allocate a new phone.
- *
- * @param[out] out_handle  New phone capability handle.
+ * @param[in]  task     Task for which to allocate a new phone.
+ * @param[in]  publish  If true, the new capability will be published.
+ * @param[out] phandle  New phone capability handle.
+ * @param[out] kobject  New phone kobject.
  *
  * @return  An error code if a new capability cannot be allocated.
  */
-errno_t phone_alloc(task_t *task, cap_handle_t *out_handle)
+errno_t phone_alloc(task_t *task, bool publish, cap_handle_t *phandle,
+    kobject_t **kobject)
 {
 	cap_handle_t handle;
@@ -166,6 +168,6 @@
 			return ENOMEM;
 		}
-		kobject_t *kobject = malloc(sizeof(kobject_t), FRAME_ATOMIC);
-		if (!kobject) {
+		kobject_t *kobj = malloc(sizeof(kobject_t), FRAME_ATOMIC);
+		if (!kobj) {
 			cap_free(TASK, handle);
 			slab_free(phone_cache, phone);
@@ -176,11 +178,14 @@
 		phone->state = IPC_PHONE_CONNECTING;
 
-		kobject_initialize(kobject, KOBJECT_TYPE_PHONE, phone,
+		kobject_initialize(kobj, KOBJECT_TYPE_PHONE, phone,
 		    &phone_kobject_ops);
-		phone->kobject = kobject;
-
-		cap_publish(task, handle, kobject);
-
-		*out_handle = handle;
+		phone->kobject = kobj;
+
+		if (publish)
+			cap_publish(task, handle, kobj);
+
+		*phandle = handle;
+		if (kobject)
+			*kobject = kobj;
 	}
 	return rc;
Index: kernel/generic/src/ipc/kbox.c
===================================================================
--- kernel/generic/src/ipc/kbox.c	(revision 50dd8544f601ebd5a6afcaa9c1a1b0dadbe951be)
+++ kernel/generic/src/ipc/kbox.c	(revision 334c103bd742e45dfad5702649323deed1a18dbe)
@@ -253,5 +253,5 @@
 	/* Allocate a new phone. */
 	cap_handle_t phone_handle;
-	errno_t rc = phone_alloc(TASK, &phone_handle);
+	errno_t rc = phone_alloc(TASK, true, &phone_handle, NULL);
 	if (rc != EOK) {
 		mutex_unlock(&task->kb.cleanup_lock);
Index: kernel/generic/src/ipc/ops/conctmeto.c
===================================================================
--- kernel/generic/src/ipc/ops/conctmeto.c	(revision 50dd8544f601ebd5a6afcaa9c1a1b0dadbe951be)
+++ kernel/generic/src/ipc/ops/conctmeto.c	(revision 334c103bd742e45dfad5702649323deed1a18dbe)
@@ -42,33 +42,14 @@
 static errno_t request_preprocess(call_t *call, phone_t *phone)
 {
+	/*
+	 * Create the new phone and capability, but don't publish them yet.
+	 * That will be done once the phone is connected.
+	 */
 	cap_handle_t phone_handle;
-	errno_t rc = phone_alloc(TASK, &phone_handle);
+	kobject_t *phone_obj;
+	errno_t rc = phone_alloc(TASK, false, &phone_handle, &phone_obj);
 	if (rc != EOK) {
 		call->priv = -1;
 		return rc;
-	}
-
-	/*
-	 * The capability is now published, but the phone is not connected yet.
-	 * The user cannot use it to send anything over it, in fact the
-	 * userspace can only unpublish and free the capability at this point.
-	 *
-	 * We now proceed to test the capability is still there. We don't care
-	 * if the user destroyed the old one and recreated a new published one
-	 * of the same type under the same handle.
-	 *
-	 * If the capability is in place we temporarily unpublish it to make
-	 * sure the user cannot fiddle with it while we are connecting.
-	 */
-
-	kobject_t *phone_obj = cap_unpublish(TASK, phone_handle,
-	    KOBJECT_TYPE_PHONE);
-	if (!phone_obj) {
-		/*
-		 * Another thread of the same task can destroy the new
-		 * capability before we manage to get a reference from it.
-		 */
-		call->priv = -1;
-		return ENOENT;
 	}
 
Index: kernel/generic/src/ipc/ops/concttome.c
===================================================================
--- kernel/generic/src/ipc/ops/concttome.c	(revision 50dd8544f601ebd5a6afcaa9c1a1b0dadbe951be)
+++ kernel/generic/src/ipc/ops/concttome.c	(revision 334c103bd742e45dfad5702649323deed1a18dbe)
@@ -43,5 +43,5 @@
 {
 	cap_handle_t phone_handle;
-	errno_t rc = phone_alloc(TASK, &phone_handle);
+	errno_t rc = phone_alloc(TASK, true, &phone_handle, NULL);
 	IPC_SET_ARG5(call->data, (rc == EOK) ? phone_handle : -1);
 	return 0;