Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h

begun with a repo-copy of mac.h to mac_framework.h.  sys/mac.h now
contains the userspace and user<->kernel API and definitions, with all
in-kernel interfaces moved to mac_framework.h, which is now included
across most of the kernel instead.

This change is the first step in a larger cleanup and sweep of MAC
Framework interfaces in the kernel, and will not be MFC'd.

Obtained from:	TrustedBSD Project
Sponsored by:	SPARTA

38 files changed, 68 insertions, 37 deletions

diff --git a/sys/kern/init_main.c b/sys/kern/init_main.c
index b33e295..1a14dc6 100644
--- a/sys/kern/init_main.c
+++ b/sys/kern/init_main.c
@@ -55,7 +55,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/filedesc.h>
 #include <sys/ktr.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/syscallsubr.h>
@@ -78,6 +77,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/cpu.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_param.h>
diff --git a/sys/kern/kern_acct.c b/sys/kern/kern_acct.c
index a005c5d..ec7289f 100644
--- a/sys/kern/kern_acct.c
+++ b/sys/kern/kern_acct.c
@@ -53,7 +53,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/kthread.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
@@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/tty.h>
 #include <sys/vnode.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * The routines implemented in this file are described in:
  *      Leffler, et al.: The Design and Implementation of the 4.3BSD
diff --git a/sys/kern/kern_acl.c b/sys/kern/kern_acl.c
index 64ffe5c..5ee9826 100644
--- a/sys/kern/kern_acl.c
+++ b/sys/kern/kern_acl.c
@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
@@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/acl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 uma_zone_t	acl_zone;
diff --git a/sys/kern/kern_alq.c b/sys/kern/kern_alq.c
index b6b24de..49aa0ac 100644
--- a/sys/kern/kern_alq.c
+++ b/sys/kern/kern_alq.c
@@ -34,7 +34,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/kthread.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
@@ -46,6 +45,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/fcntl.h>
 #include <sys/eventhandler.h>
 
+#include <security/mac/mac_framework.h>
+
 /* Async. Logging Queue */
 struct alq {
 	int	aq_entmax;		/* Max entries */
diff --git a/sys/kern/kern_environment.c b/sys/kern/kern_environment.c
index bd54063..ff26529 100644
--- a/sys/kern/kern_environment.c
+++ b/sys/kern/kern_environment.c
@@ -44,7 +44,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/proc.h>
 #include <sys/queue.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/kernel.h>
@@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/libkern.h>
 #include <sys/kenv.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_KENV, "kenv", "kernel environment");
 
 #define KENV_SIZE	512	/* Maximum number of environment strings */
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index 97825cb..be7dbe6 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -39,7 +39,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysproto.h>
 #include <sys/signalvar.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/filedesc.h>
 #include <sys/fcntl.h>
@@ -80,6 +79,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/reg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
 
diff --git a/sys/kern/kern_exit.c b/sys/kern/kern_exit.c
index c857413..1e57aae 100644
--- a/sys/kern/kern_exit.c
+++ b/sys/kern/kern_exit.c
@@ -65,7 +65,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/ptrace.h>
 #include <sys/acct.h>		/* for acct_process() function prototype */
 #include <sys/filedesc.h>
-#include <sys/mac.h>
 #include <sys/shm.h>
 #include <sys/sem.h>
 #ifdef KTRACE
@@ -73,6 +72,7 @@ __FBSDID("$FreeBSD$");
 #endif
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_extern.h>
diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c
index c0b30e6..2695252 100644
--- a/sys/kern/kern_fork.c
+++ b/sys/kern/kern_fork.c
@@ -59,7 +59,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/vmmeter.h>
 #include <sys/vnode.h>
 #include <sys/acct.h>
-#include <sys/mac.h>
 #include <sys/ktr.h>
 #include <sys/ktrace.h>
 #include <sys/unistd.h>	
@@ -67,6 +66,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/signalvar.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/pmap.h>
diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
index be4757d..3924388 100644
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -18,7 +18,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/errno.h>
 #include <sys/sysproto.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/proc.h>
 #include <sys/taskqueue.h>
@@ -35,6 +34,8 @@ __FBSDID("$FreeBSD$");
 #include <net/if.h>
 #include <netinet/in.h>
 
+#include <security/mac/mac_framework.h>
+
 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
 
 SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,
diff --git a/sys/kern/kern_ktrace.c b/sys/kern/kern_ktrace.c
index 0277cc3..e79fa7c 100644
--- a/sys/kern/kern_ktrace.c
+++ b/sys/kern/kern_ktrace.c
@@ -44,7 +44,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kthread.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/namei.h>
@@ -57,6 +56,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/syslog.h>
 #include <sys/sysproto.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * The ktrace facility allows the tracing of certain key events in user space
  * processes, such as system calls, signal delivery, context switches, and
diff --git a/sys/kern/kern_linker.c b/sys/kern/kern_linker.c
index 026d5b6..0bdd9f8 100644
--- a/sys/kern/kern_linker.c
+++ b/sys/kern/kern_linker.c
@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/sx.h>
-#include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/mount.h>
 #include <sys/linker.h>
@@ -52,6 +51,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/syscallsubr.h>
 #include <sys/sysctl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include "linker_if.h"
 
 #ifdef HWPMC_HOOKS
diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index b553c80..8d69dcc 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -2,7 +2,7 @@
  * Copyright (c) 1999-2002 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
- * Copyright (c) 2005 SPARTA, Inc.
+ * Copyright (c) 2005-2006 SPARTA, Inc.
  * All rights reserved.
  *
  * This software was developed by Robert Watson and Ilmar Habibulin for the
@@ -91,6 +91,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/in.h>
 #include <netinet/ip_var.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 #ifdef MAC
diff --git a/sys/kern/kern_mbuf.c b/sys/kern/kern_mbuf.c
index e43d323..0f99924 100644
--- a/sys/kern/kern_mbuf.c
+++ b/sys/kern/kern_mbuf.c
@@ -32,7 +32,6 @@ __FBSDID("$FreeBSD$");
 #include "opt_param.h"
 
 #include <sys/param.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
@@ -43,6 +42,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/smp.h>
 #include <sys/sysctl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_page.h>
 #include <vm/uma.h>
diff --git a/sys/kern/kern_prot.c b/sys/kern/kern_prot.c
index a42ab93..daa8966 100644
--- a/sys/kern/kern_prot.c
+++ b/sys/kern/kern_prot.c
@@ -51,7 +51,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kdb.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/refcount.h>
@@ -67,6 +66,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysctl.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 static MALLOC_DEFINE(M_CRED, "cred", "credentials");
 
diff --git a/sys/kern/kern_shutdown.c b/sys/kern/kern_shutdown.c
index 3b62ba2..a5bcfa8 100644
--- a/sys/kern/kern_shutdown.c
+++ b/sys/kern/kern_shutdown.c
@@ -53,7 +53,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kdb.h>
 #include <sys/kernel.h>
 #include <sys/kthread.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
@@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$");
 #include <machine/pcb.h>
 #include <machine/smp.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_object.h>
 #include <vm/vm_page.h>
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index 84a5209..a929291 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -45,13 +45,15 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/proc.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/sysproto.h>
+
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_extern.h>
 
diff --git a/sys/kern/kern_time.c b/sys/kern/kern_time.c
index 0bdde95..479348e 100644
--- a/sys/kern/kern_time.c
+++ b/sys/kern/kern_time.c
@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/resourcevar.h>
 #include <sys/signalvar.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/syscallsubr.h>
 #include <sys/sysctl.h>
 #include <sys/sysent.h>
@@ -57,6 +56,8 @@ __FBSDID("$FreeBSD$");
 
 #include <posix4/posix4.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_extern.h>
 
diff --git a/sys/kern/link_elf.c b/sys/kern/link_elf.c
index 35e97b8..b78776a 100644
--- a/sys/kern/link_elf.c
+++ b/sys/kern/link_elf.c
@@ -37,7 +37,6 @@ __FBSDID("$FreeBSD$");
 #endif
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/mount.h>
@@ -49,6 +48,8 @@ __FBSDID("$FreeBSD$");
 
 #include <machine/elf.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_param.h>
 #ifdef SPARSE_MAPPING
diff --git a/sys/kern/link_elf_obj.c b/sys/kern/link_elf_obj.c
index 8e11038..a926d54 100644
--- a/sys/kern/link_elf_obj.c
+++ b/sys/kern/link_elf_obj.c
@@ -35,7 +35,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/mount.h>
@@ -47,6 +46,8 @@ __FBSDID("$FreeBSD$");
 
 #include <machine/elf.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_param.h>
 #include <vm/vm_object.h>
diff --git a/sys/kern/subr_trap.c b/sys/kern/subr_trap.c
index d5c03b7..efb6a6e 100644
--- a/sys/kern/subr_trap.c
+++ b/sys/kern/subr_trap.c
@@ -50,7 +50,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/ktr.h>
@@ -67,6 +66,8 @@ __FBSDID("$FreeBSD$");
 #include <machine/cpu.h>
 #include <machine/pcb.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * Define the code needed before returning to user mode, for
  * trap and syscall.
diff --git a/sys/kern/sys_pipe.c b/sys/kern/sys_pipe.c
index b873a8b..46a4a4f 100644
--- a/sys/kern/sys_pipe.c
+++ b/sys/kern/sys_pipe.c
@@ -101,7 +101,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/filio.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/ttycom.h>
 #include <sys/stat.h>
@@ -117,6 +116,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/event.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_param.h>
 #include <vm/vm_object.h>
diff --git a/sys/kern/sys_socket.c b/sys/kern/sys_socket.c
index 4d0a1ac..a429911 100644
--- a/sys/kern/sys_socket.c
+++ b/sys/kern/sys_socket.c
@@ -38,7 +38,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
-#include <sys/mac.h>
 #include <sys/proc.h>
 #include <sys/protosw.h>
 #include <sys/sigio.h>
@@ -55,6 +54,8 @@ __FBSDID("$FreeBSD$");
 #include <net/if.h>
 #include <net/route.h>
 
+#include <security/mac/mac_framework.h>
+
 struct	fileops socketops = {
 	.fo_read = soo_read,
 	.fo_write = soo_write,
diff --git a/sys/kern/sysv_msg.c b/sys/kern/sysv_msg.c
index dca24de..464a7e5 100644
--- a/sys/kern/sysv_msg.c
+++ b/sys/kern/sysv_msg.c
@@ -59,7 +59,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/proc.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/module.h>
 #include <sys/msg.h>
@@ -70,6 +69,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/malloc.h>
 #include <sys/jail.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues");
 
 static void msginit(void);
diff --git a/sys/kern/sysv_sem.c b/sys/kern/sysv_sem.c
index 29eaecf..cc9fe67 100644
--- a/sys/kern/sysv_sem.c
+++ b/sys/kern/sysv_sem.c
@@ -59,7 +59,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/malloc.h>
 #include <sys/jail.h>
-#include <sys/mac.h>
+
+#include <security/mac/mac_framework.h>
 
 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores");
 
diff --git a/sys/kern/sysv_shm.c b/sys/kern/sysv_shm.c
index efcc1f6..2fc2d71 100644
--- a/sys/kern/sysv_shm.c
+++ b/sys/kern/sysv_shm.c
@@ -84,7 +84,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/sysproto.h>
 #include <sys/jail.h>
-#include <sys/mac.h>
+
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_param.h>
diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c
index 5b5714f..216ff54 100644
--- a/sys/kern/uipc_mbuf.c
+++ b/sys/kern/uipc_mbuf.c
@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/sysctl.h>
@@ -49,6 +48,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/protosw.h>
 #include <sys/uio.h>
 
+#include <security/mac/mac_framework.h>
+
 int	max_linkhdr;
 int	max_protohdr;
 int	max_hdr;
diff --git a/sys/kern/uipc_mbuf2.c b/sys/kern/uipc_mbuf2.c
index 109b3a6..c8363f8 100644
--- a/sys/kern/uipc_mbuf2.c
+++ b/sys/kern/uipc_mbuf2.c
@@ -71,11 +71,12 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/mutex.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_PACKET_TAGS, MBUF_TAG_MEM_NAME,
     "packet-attached information");
 
diff --git a/sys/kern/uipc_sem.c b/sys/kern/uipc_sem.c
index 9e8b279..8de7d8f 100644
--- a/sys/kern/uipc_sem.c
+++ b/sys/kern/uipc_sem.c
@@ -54,7 +54,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/sysctl.h>
 #include <sys/time.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/fcntl.h>
 
@@ -63,6 +62,8 @@ __FBSDID("$FreeBSD$");
 #include <posix4/semaphore.h>
 #include <posix4/_semaphore.h>
 
+#include <security/mac/mac_framework.h>
+
 static int sem_count_proc(struct proc *p);
 static struct ksem *sem_lookup_byname(const char *name);
 static int sem_create(struct thread *td, const char *name,
diff --git a/sys/kern/uipc_socket.c b/sys/kern/uipc_socket.c
index 2a27388..341b54c 100644
--- a/sys/kern/uipc_socket.c
+++ b/sys/kern/uipc_socket.c
@@ -126,6 +126,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/jail.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 #ifdef COMPAT_IA32
diff --git a/sys/kern/uipc_syscalls.c b/sys/kern/uipc_syscalls.c
index 23437a3..462bde4 100644
--- a/sys/kern/uipc_syscalls.c
+++ b/sys/kern/uipc_syscalls.c
@@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/sysproto.h>
 #include <sys/malloc.h>
@@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/ktrace.h>
 #endif
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_object.h>
 #include <vm/vm_page.h>
diff --git a/sys/kern/uipc_usrreq.c b/sys/kern/uipc_usrreq.c
index 723c132..33a6ec2 100644
--- a/sys/kern/uipc_usrreq.c
+++ b/sys/kern/uipc_usrreq.c
@@ -64,7 +64,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -84,6 +83,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/unpcb.h>
 #include <sys/vnode.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 static uma_zone_t unp_zone;
diff --git a/sys/kern/vfs_acl.c b/sys/kern/vfs_acl.c
index 64ffe5c..5ee9826 100644
--- a/sys/kern/vfs_acl.c
+++ b/sys/kern/vfs_acl.c
@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
@@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/acl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 uma_zone_t	acl_zone;
diff --git a/sys/kern/vfs_extattr.c b/sys/kern/vfs_extattr.c
index d23f19b..81529f0 100644
--- a/sys/kern/vfs_extattr.c
+++ b/sys/kern/vfs_extattr.c
@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/bio.h>
 #include <sys/buf.h>
 #include <sys/sysent.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -71,6 +70,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/stdarg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_object.h>
diff --git a/sys/kern/vfs_lookup.c b/sys/kern/vfs_lookup.c
index a59b39d..a0cbc83 100644
--- a/sys/kern/vfs_lookup.c
+++ b/sys/kern/vfs_lookup.c
@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>
@@ -59,6 +58,7 @@ __FBSDID("$FreeBSD$");
 #endif
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/uma.h>
 
diff --git a/sys/kern/vfs_mount.c b/sys/kern/vfs_mount.c
index 0598905..af07f44 100644
--- a/sys/kern/vfs_mount.c
+++ b/sys/kern/vfs_mount.c
@@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/libkern.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -65,6 +64,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/stdarg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include "opt_rootdevname.h"
 #include "opt_ddb.h"
diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c
index 28fbda9..c621743 100644
--- a/sys/kern/vfs_subr.c
+++ b/sys/kern/vfs_subr.c
@@ -58,7 +58,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kdb.h>
 #include <sys/kernel.h>
 #include <sys/kthread.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/namei.h>
@@ -72,6 +71,8 @@ __FBSDID("$FreeBSD$");
 
 #include <machine/stdarg.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_object.h>
 #include <vm/vm_extern.h>
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index d23f19b..81529f0 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/bio.h>
 #include <sys/buf.h>
 #include <sys/sysent.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -71,6 +70,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/stdarg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_object.h>
diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c
index d71b28b..4a516a7 100644
--- a/sys/kern/vfs_vnops.c
+++ b/sys/kern/vfs_vnops.c
@@ -48,7 +48,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/proc.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
@@ -62,6 +61,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/syslog.h>
 #include <sys/unistd.h>
 
+#include <security/mac/mac_framework.h>
+
 static fo_rdwr_t	vn_read;
 static fo_rdwr_t	vn_write;
 static fo_ioctl_t	vn_ioctl;