Begin committing support for Mandatory Access Control and extensible

kernel access control.  The MAC framework permits loadable kernel
modules to link to the kernel at compile-time, boot-time, or run-time,
and augment the system security policy.  This commit includes the
initial kernel implementation, although the interface with the userland
components of the oeprating system is still under work, and not all
kernel subsystems are supported.  Later in this commit sequence,
documentation of which kernel subsystems will not work correctly with
a kernel compiled with MAC support will be added.

kern_mac.c contains the body of the MAC framework.  Kernel and
user APIs defined in mac.h are implemented here, providing a front end
to loaded security modules.  This code implements a module registration
service, state (label) management, security configuration and policy
composition.

Obtained from:	TrustedBSD Project
Sponsored by:	DARPA, NAI Labs

8 files changed, 24128 insertions, 0 deletions

diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 200ba7c..6d3f124 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -47,8 +47,3022 @@
 
 #include "opt_mac.h"
 #include <sys/param.h>
+#include <sys/extattr.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/mutex.h>
+#include <sys/sx.h>
+#include <sys/mac.h>
+#include <sys/proc.h>
+#include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
+#include <sys/vnode.h>
+#include <sys/mount.h>
+#include <sys/file.h>
+#include <sys/namei.h>
+#include <sys/socket.h>
+#include <sys/pipe.h>
+#include <sys/socketvar.h>
+#include <sys/sx.h>
+#include <sys/sysctl.h>
+
+#include <vm/vm.h>
+#include <vm/pmap.h>
+#include <vm/vm_map.h>
+#include <vm/vm_object.h>
+
+#include <sys/mac_policy.h>
+
+#include <fs/devfs/devfs.h>
+
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+#include <net/if.h>
+#include <net/if_var.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+
+#ifdef MAC
+
+SYSCTL_DECL(_security);
+
+SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW, 0,
+    "TrustedBSD MAC policy controls");
+SYSCTL_NODE(_security_mac, OID_AUTO, debug, CTLFLAG_RW, 0,
+    "TrustedBSD MAC debug info");
+
+static int	mac_debug_label_fallback = 0;
+SYSCTL_INT(_security_mac_debug, OID_AUTO, label_fallback, CTLFLAG_RW,
+    &mac_debug_label_fallback, 0, "Filesystems should fall back to fs label"
+    "when label is corrupted.");
+TUNABLE_INT("security.mac.debug_label_fallback",
+    &mac_debug_label_fallback);
+
+#ifndef MAC_MAX_POLICIES
+#define	MAC_MAX_POLICIES	8
+#endif
+#if MAC_MAX_POLICIES > 32
+#error "MAC_MAX_POLICIES too large"
+#endif
+static unsigned int mac_max_policies = MAC_MAX_POLICIES;
+static unsigned int mac_policy_offsets_free = (1 << MAC_MAX_POLICIES) - 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, max_policies, CTLFLAG_RD,
+    &mac_max_policies, 0, "");
+
+static int	mac_late = 0;
+
+static int	mac_enforce_fs = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_fs, CTLFLAG_RW,
+    &mac_enforce_fs, 0, "Enforce MAC policy on file system objects");
+TUNABLE_INT("security.mac.enforce_fs", &mac_enforce_fs);
+
+static int	mac_enforce_network = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_network, CTLFLAG_RW,
+    &mac_enforce_network, 0, "Enforce MAC policy on network packets");
+TUNABLE_INT("security.mac.enforce_network", &mac_enforce_network);
+
+static int	mac_enforce_process = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_process, CTLFLAG_RW,
+    &mac_enforce_process, 0, "Enforce MAC policy on inter-process operations");
+TUNABLE_INT("security.mac.enforce_process", &mac_enforce_process);
+
+static int	mac_enforce_socket = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_socket, CTLFLAG_RW,
+    &mac_enforce_socket, 0, "Enforce MAC policy on socket operations");
+TUNABLE_INT("security.mac.enforce_socket", &mac_enforce_socket);
+
+static int	mac_enforce_pipe = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, enforce_pipe, CTLFLAG_RW,
+    &mac_enforce_pipe, 0, "Enforce MAC policy on pipe operations");
+
+static int	mac_label_size = sizeof(struct mac);
+SYSCTL_INT(_security_mac, OID_AUTO, label_size, CTLFLAG_RD,
+    &mac_label_size, 0, "Pre-compiled MAC label size");
+
+static int	mac_cache_fslabel_in_vnode = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, cache_fslabel_in_vnode, CTLFLAG_RW,
+    &mac_cache_fslabel_in_vnode, 0, "Cache mount fslabel in vnode");
+TUNABLE_INT("security.mac.cache_fslabel_in_vnode",
+    &mac_cache_fslabel_in_vnode);
+
+static int	mac_vnode_label_cache_hits = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_hits, CTLFLAG_RD,
+    &mac_vnode_label_cache_hits, 0, "Cache hits on vnode labels");
+static int	mac_vnode_label_cache_misses = 0;
+SYSCTL_INT(_security_mac, OID_AUTO, vnode_label_cache_misses, CTLFLAG_RD,
+    &mac_vnode_label_cache_misses, 0, "Cache misses on vnode labels");
+static int	mac_mmap_revocation_via_cow = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
+    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
+    "copy-on-write semantics, or by removing all write access");
+
+static unsigned int nmacmbufs, nmaccreds, nmacifnets, nmacbpfdescs,
+    nmacsockets, nmacmounts, nmactemp, nmacvnodes, nmacdevfsdirents,
+    nmacipqs, nmacpipes;
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mbufs, CTLFLAG_RD,
+    &nmacmbufs, 0, "number of mbufs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, creds, CTLFLAG_RD,
+    &nmaccreds, 0, "number of ucreds in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ifnets, CTLFLAG_RD,
+    &nmacifnets, 0, "number of ifnets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, ipqs, CTLFLAG_RD,
+    &nmacipqs, 0, "number of ipqs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, bpfdescs, CTLFLAG_RD,
+    &nmacbpfdescs, 0, "number of bpfdescs in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, sockets, CTLFLAG_RD,
+    &nmacsockets, 0, "number of sockets in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, pipes, CTLFLAG_RD,
+    &nmacpipes, 0, "number of pipes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, mounts, CTLFLAG_RD,
+    &nmacmounts, 0, "number of mounts in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, temp, CTLFLAG_RD,
+    &nmactemp, 0, "number of temporary labels in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, vnodes, CTLFLAG_RD,
+    &nmacvnodes, 0, "number of vnodes in use");
+SYSCTL_UINT(_security_mac_debug, OID_AUTO, devfsdirents, CTLFLAG_RD,
+    &nmacdevfsdirents, 0, "number of devfs dirents inuse");
+
+static int	error_select(int error1, int error2);
+static int	mac_externalize(struct label *label, struct mac *mac);
+static int	mac_policy_register(struct mac_policy_conf *mpc);
+static int	mac_policy_unregister(struct mac_policy_conf *mpc);
+
+static int	mac_stdcreatevnode_ea(struct vnode *vp);
+static void	mac_cred_mmapped_drop_perms(struct thread *td,
+		    struct ucred *cred);
+static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
+		    struct ucred *cred, struct vm_map *map);
+
+MALLOC_DEFINE(M_MACOPVEC, "macopvec", "MAC policy operation vector");
+MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
+
+/*
+ * mac_policy_list_lock protects the consistency of 'mac_policy_list',
+ * the linked list of attached policy modules.  Read-only consumers of
+ * the list must acquire a shared lock for the duration of their use;
+ * writers must acquire an exclusive lock.  Note that for compound
+ * operations, locks should be held for the entire compound operation,
+ * and that this is not yet done for relabel requests.
+ */
+static struct mtx mac_policy_list_lock;
+static LIST_HEAD(, mac_policy_conf) mac_policy_list;
+static int mac_policy_list_busy;
+#define	MAC_POLICY_LIST_LOCKINIT()	mtx_init(&mac_policy_list_lock,	\
+	"mac_policy_list_lock", NULL, MTX_DEF);
+#define	MAC_POLICY_LIST_LOCK()	mtx_lock(&mac_policy_list_lock);
+#define	MAC_POLICY_LIST_UNLOCK()	mtx_unlock(&mac_policy_list_lock);
+
+#define	MAC_POLICY_LIST_BUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy++;						\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+#define	MAC_POLICY_LIST_UNBUSY() do {					\
+	MAC_POLICY_LIST_LOCK();						\
+	mac_policy_list_busy--;						\
+	if (mac_policy_list_busy < 0)					\
+		panic("Extra mac_policy_list_busy--");			\
+	MAC_POLICY_LIST_UNLOCK();					\
+} while (0)
+
+/*
+ * MAC_CHECK performs the designated check by walking the policy
+ * module list and checking with each as to how it feels about the
+ * request.  Note that it returns its value via 'error' in the scope
+ * of the caller.
+ */
+#define	MAC_CHECK(check, args...) do {					\
+	struct mac_policy_conf *mpc;					\
+									\
+	error = 0;							\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## check != NULL)		\
+			error = error_select(				\
+			    mpc->mpc_ops->mpo_ ## check (args),		\
+			    error);					\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_BOOLEAN performs the designated boolean composition by walking
+ * the module list, invoking each instance of the operation, and
+ * combining the results using the passed C operator.  Note that it
+ * returns its value via 'result' in the scope of the caller, which
+ * should be initialized by the caller in a meaningful way to get
+ * a meaningful result.
+ */
+#define	MAC_BOOLEAN(operation, composition, args...) do {		\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			result = result composition			\
+			    mpc->mpc_ops->mpo_ ## operation (args);	\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * MAC_PERFORM performs the designated operation by walking the policy
+ * module list and invoking that operation for each policy.
+ */
+#define	MAC_PERFORM(operation, args...) do {				\
+	struct mac_policy_conf *mpc;					\
+									\
+	MAC_POLICY_LIST_BUSY();						\
+	LIST_FOREACH(mpc, &mac_policy_list, mpc_list) {			\
+		if (mpc->mpc_ops->mpo_ ## operation != NULL)		\
+			mpc->mpc_ops->mpo_ ## operation (args);		\
+	}								\
+	MAC_POLICY_LIST_UNBUSY();					\
+} while (0)
+
+/*
+ * Initialize the MAC subsystem, including appropriate SMP locks.
+ */
+static void
+mac_init(void)
+{
+
+	LIST_INIT(&mac_policy_list);
+	MAC_POLICY_LIST_LOCKINIT();
+}
+
+/*
+ * For the purposes of modules that want to know if they were loaded
+ * "early", set the mac_late flag once we've processed modules either
+ * linked into the kernel, or loaded before the kernel startup.
+ */
+static void
+mac_late_init(void)
+{
+
+	mac_late = 1;
+}
+
+/*
+ * Allow MAC policy modules to register during boot, etc.
+ */
+int
+mac_policy_modevent(module_t mod, int type, void *data)
+{
+	struct mac_policy_conf *mpc;
+	int error;
+
+	error = 0;
+	mpc = (struct mac_policy_conf *) data;
+
+	switch (type) {
+	case MOD_LOAD:
+		if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE &&
+		    mac_late) {
+			printf("mac_policy_modevent: can't load %s policy "
+			    "after booting\n", mpc->mpc_name);
+			error = EBUSY;
+			break;
+		}
+		error = mac_policy_register(mpc);
+		break;
+	case MOD_UNLOAD:
+		/* Don't unregister the module if it was never registered. */
+		if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED)
+		    != 0)
+			error = mac_policy_unregister(mpc);
+		else
+			error = 0;
+		break;
+	default:
+		break;
+	}
+
+	return (error);
+}
+
+static int
+mac_policy_register(struct mac_policy_conf *mpc)
+{
+	struct mac_policy_conf *tmpc;
+	struct mac_policy_ops *ops;
+	struct mac_policy_op_entry *mpe;
+	int slot;
+
+	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*ops), M_MACOPVEC,
+	    M_WAITOK | M_ZERO);
+	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
+		switch (mpe->mpe_constant) {
+		case MAC_OP_LAST:
+			/*
+			 * Doesn't actually happen, but this allows checking
+			 * that all enumerated values are handled.
+			 */
+			break;
+		case MAC_DESTROY:
+			mpc->mpc_ops->mpo_destroy =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT:
+			mpc->mpc_ops->mpo_init =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_BPFDESC:
+			mpc->mpc_ops->mpo_init_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_CRED:
+			mpc->mpc_ops->mpo_init_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_init_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IFNET:
+			mpc->mpc_ops->mpo_init_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_IPQ:
+			mpc->mpc_ops->mpo_init_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MBUF:
+			mpc->mpc_ops->mpo_init_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_MOUNT:
+			mpc->mpc_ops->mpo_init_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_PIPE:
+			mpc->mpc_ops->mpo_init_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_SOCKET:
+			mpc->mpc_ops->mpo_init_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_TEMP:
+			mpc->mpc_ops->mpo_init_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_INIT_VNODE:
+			mpc->mpc_ops->mpo_init_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_BPFDESC:
+			mpc->mpc_ops->mpo_destroy_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_CRED:
+			mpc->mpc_ops->mpo_destroy_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_destroy_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IFNET:
+			mpc->mpc_ops->mpo_destroy_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_IPQ:
+			mpc->mpc_ops->mpo_destroy_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MBUF:
+			mpc->mpc_ops->mpo_destroy_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_MOUNT:
+			mpc->mpc_ops->mpo_destroy_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_PIPE:
+			mpc->mpc_ops->mpo_destroy_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_SOCKET:
+			mpc->mpc_ops->mpo_destroy_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_TEMP:
+			mpc->mpc_ops->mpo_destroy_temp =
+			    mpe->mpe_function;
+			break;
+		case MAC_DESTROY_VNODE:
+			mpc->mpc_ops->mpo_destroy_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXTERNALIZE:
+			mpc->mpc_ops->mpo_externalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_INTERNALIZE:
+			mpc->mpc_ops->mpo_internalize =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DEVICE:
+			mpc->mpc_ops->mpo_create_devfs_device =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_DIRECTORY:
+			mpc->mpc_ops->mpo_create_devfs_directory =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DEVFS_VNODE:
+			mpc->mpc_ops->mpo_create_devfs_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_STDCREATEVNODE_EA:
+			mpc->mpc_ops->mpo_stdcreatevnode_ea =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_VNODE:
+			mpc->mpc_ops->mpo_create_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MOUNT:
+			mpc->mpc_ops->mpo_create_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_ROOT_MOUNT:
+			mpc->mpc_ops->mpo_create_root_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_VNODE:
+			mpc->mpc_ops->mpo_relabel_vnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_DEVFSDIRENT:
+			mpc->mpc_ops->mpo_update_devfsdirent =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_PROCFSVNODE:
+			mpc->mpc_ops->mpo_update_procfsvnode =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTATTR:
+			mpc->mpc_ops->mpo_update_vnode_from_extattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_EXTERNALIZED:
+			mpc->mpc_ops->mpo_update_vnode_from_externalized =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_VNODE_FROM_MOUNT:
+			mpc->mpc_ops->mpo_update_vnode_from_mount =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_mbuf_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PIPE:
+			mpc->mpc_ops->mpo_create_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET:
+			mpc->mpc_ops->mpo_create_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_SOCKET_FROM_SOCKET:
+			mpc->mpc_ops->mpo_create_socket_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_PIPE:
+			mpc->mpc_ops->mpo_relabel_pipe =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_SOCKET:
+			mpc->mpc_ops->mpo_relabel_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_MBUF:
+			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
+			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_BPFDESC:
+			mpc->mpc_ops->mpo_create_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_DATAGRAM_FROM_IPQ:
+			mpc->mpc_ops->mpo_create_datagram_from_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_FRAGMENT:
+			mpc->mpc_ops->mpo_create_fragment =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IFNET:
+			mpc->mpc_ops->mpo_create_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_IPQ:
+			mpc->mpc_ops->mpo_create_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_MBUF:
+			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_LINKLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_linklayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_BPFDESC:
+			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_FROM_IFNET:
+			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
+			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_MBUF_NETLAYER:
+			mpc->mpc_ops->mpo_create_mbuf_netlayer =
+			    mpe->mpe_function;
+			break;
+		case MAC_FRAGMENT_MATCH:
+			mpc->mpc_ops->mpo_fragment_match =
+			    mpe->mpe_function;
+			break;
+		case MAC_RELABEL_IFNET:
+			mpc->mpc_ops->mpo_relabel_ifnet =
+			    mpe->mpe_function;
+			break;
+		case MAC_UPDATE_IPQ:
+			mpc->mpc_ops->mpo_update_ipq =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_CRED:
+			mpc->mpc_ops->mpo_create_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_TRANSITION:
+			mpc->mpc_ops->mpo_execve_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_EXECVE_WILL_TRANSITION:
+			mpc->mpc_ops->mpo_execve_will_transition =
+			    mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC0:
+			mpc->mpc_ops->mpo_create_proc0 = mpe->mpe_function;
+			break;
+		case MAC_CREATE_PROC1:
+			mpc->mpc_ops->mpo_create_proc1 = mpe->mpe_function;
+			break;
+		case MAC_RELABEL_CRED:
+			mpc->mpc_ops->mpo_relabel_cred =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_BPFDESC_RECEIVE:
+			mpc->mpc_ops->mpo_check_bpfdesc_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_RELABEL:
+			mpc->mpc_ops->mpo_check_cred_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_CRED_VISIBLE:
+			mpc->mpc_ops->mpo_check_cred_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_RELABEL:
+			mpc->mpc_ops->mpo_check_ifnet_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_IFNET_TRANSMIT:
+			mpc->mpc_ops->mpo_check_ifnet_transmit =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_MOUNT_STAT:
+			mpc->mpc_ops->mpo_check_mount_stat =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_IOCTL:
+			mpc->mpc_ops->mpo_check_pipe_ioctl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_OP:
+			mpc->mpc_ops->mpo_check_pipe_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PIPE_RELABEL:
+			mpc->mpc_ops->mpo_check_pipe_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_DEBUG:
+			mpc->mpc_ops->mpo_check_proc_debug =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SCHED:
+			mpc->mpc_ops->mpo_check_proc_sched =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_PROC_SIGNAL:
+			mpc->mpc_ops->mpo_check_proc_signal =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_BIND:
+			mpc->mpc_ops->mpo_check_socket_bind =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_CONNECT:
+			mpc->mpc_ops->mpo_check_socket_connect =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_LISTEN:
+			mpc->mpc_ops->mpo_check_socket_listen =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RECEIVE:
+			mpc->mpc_ops->mpo_check_socket_receive =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_RELABEL:
+			mpc->mpc_ops->mpo_check_socket_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_SOCKET_VISIBLE:
+			mpc->mpc_ops->mpo_check_socket_visible =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_ACCESS:
+			mpc->mpc_ops->mpo_check_vnode_access =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHDIR:
+			mpc->mpc_ops->mpo_check_vnode_chdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CHROOT:
+			mpc->mpc_ops->mpo_check_vnode_chroot =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_CREATE:
+			mpc->mpc_ops->mpo_check_vnode_create =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETE:
+			mpc->mpc_ops->mpo_check_vnode_delete =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_DELETEACL:
+			mpc->mpc_ops->mpo_check_vnode_deleteacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_EXEC:
+			mpc->mpc_ops->mpo_check_vnode_exec =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETACL:
+			mpc->mpc_ops->mpo_check_vnode_getacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_GETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_getextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_LOOKUP:
+			mpc->mpc_ops->mpo_check_vnode_lookup =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_MMAP_PERMS:
+			mpc->mpc_ops->mpo_check_vnode_mmap_perms =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OP:
+			mpc->mpc_ops->mpo_check_vnode_op =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_OPEN:
+			mpc->mpc_ops->mpo_check_vnode_open =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READDIR:
+			mpc->mpc_ops->mpo_check_vnode_readdir =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_READLINK:
+			mpc->mpc_ops->mpo_check_vnode_readlink =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RELABEL:
+			mpc->mpc_ops->mpo_check_vnode_relabel =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_FROM:
+			mpc->mpc_ops->mpo_check_vnode_rename_from =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_RENAME_TO:
+			mpc->mpc_ops->mpo_check_vnode_rename_to =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_REVOKE:
+			mpc->mpc_ops->mpo_check_vnode_revoke =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETACL:
+			mpc->mpc_ops->mpo_check_vnode_setacl =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETEXTATTR:
+			mpc->mpc_ops->mpo_check_vnode_setextattr =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETFLAGS:
+			mpc->mpc_ops->mpo_check_vnode_setflags =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETMODE:
+			mpc->mpc_ops->mpo_check_vnode_setmode =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETOWNER:
+			mpc->mpc_ops->mpo_check_vnode_setowner =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_SETUTIMES:
+			mpc->mpc_ops->mpo_check_vnode_setutimes =
+			    mpe->mpe_function;
+			break;
+		case MAC_CHECK_VNODE_STAT:
+			mpc->mpc_ops->mpo_check_vnode_stat =
+			    mpe->mpe_function;
+			break;
+/*
+		default:
+			printf("MAC policy `%s': unknown operation %d\n",
+			    mpc->mpc_name, mpe->mpe_constant);
+			return (EINVAL);
+*/
+		}
+	}
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		FREE(mpc->mpc_ops, M_MACOPVEC);
+		mpc->mpc_ops = NULL;
+		return (EBUSY);
+	}
+	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
+		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (EEXIST);
+		}
+	}
+	if (mpc->mpc_field_off != NULL) {
+		slot = ffs(mac_policy_offsets_free);
+		if (slot == 0) {
+			MAC_POLICY_LIST_UNLOCK();
+			FREE(mpc->mpc_ops, M_MACOPVEC);
+			mpc->mpc_ops = NULL;
+			return (ENOMEM);
+		}
+		slot--;
+		mac_policy_offsets_free &= ~(1 << slot);
+		*mpc->mpc_field_off = slot;
+	}
+	mpc->mpc_runtime_flags |= MPC_RUNTIME_FLAG_REGISTERED;
+	LIST_INSERT_HEAD(&mac_policy_list, mpc, mpc_list);
+
+	/* Per-policy initialization. */
+	if (mpc->mpc_ops->mpo_init != NULL)
+		(*(mpc->mpc_ops->mpo_init))(mpc);
+	MAC_POLICY_LIST_UNLOCK();
+
+	printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+static int
+mac_policy_unregister(struct mac_policy_conf *mpc)
+{
+
+#if 0
+	/*
+	 * Don't allow unloading modules with private data.
+	 */
+	if (mpc->mpc_field_off != NULL)
+		return (EBUSY);
+#endif
+	if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0)
+		return (EBUSY);
+	MAC_POLICY_LIST_LOCK();
+	if (mac_policy_list_busy > 0) {
+		MAC_POLICY_LIST_UNLOCK();
+		return (EBUSY);
+	}
+	if (mpc->mpc_ops->mpo_destroy != NULL)
+		(*(mpc->mpc_ops->mpo_destroy))(mpc);
+
+	LIST_REMOVE(mpc, mpc_list);
+	MAC_POLICY_LIST_UNLOCK();
+
+	FREE(mpc->mpc_ops, M_MACOPVEC);
+	mpc->mpc_ops = NULL;
+
+	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
+	    mpc->mpc_name);
+
+	return (0);
+}
+
+/*
+ * Define an error value precedence, and given two arguments, selects the
+ * value with the higher precedence.
+ */
+static int
+error_select(int error1, int error2)
+{
+
+	/* Certain decision-making errors take top priority. */
+	if (error1 == EDEADLK || error2 == EDEADLK)
+		return (EDEADLK);
+
+	/* Invalid arguments should be reported where possible. */
+	if (error1 == EINVAL || error2 == EINVAL)
+		return (EINVAL);
+
+	/* Precedence goes to "visibility", with both process and file. */
+	if (error1 == ESRCH || error2 == ESRCH)
+		return (ESRCH);
+
+	if (error1 == ENOENT || error2 == ENOENT)
+		return (ENOENT);
+
+	/* Precedence goes to DAC/MAC protections. */
+	if (error1 == EACCES || error2 == EACCES)
+		return (EACCES);
+
+	/* Precedence goes to privilege. */
+	if (error1 == EPERM || error2 == EPERM)
+		return (EPERM);
+
+	/* Precedence goes to error over success; otherwise, arbitrary. */
+	if (error1 != 0)
+		return (error1);
+	return (error2);
+}
+
+void
+mac_update_devfsdirent(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(update_devfsdirent, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_update_procfsvnode(struct vnode *vp, struct ucred *cred)
+{
+
+	MAC_PERFORM(update_procfsvnode, vp, &vp->v_label, cred);
+}
+
+/*
+ * Support callout for policies that manage their own externalization
+ * using extended attributes.
+ */
+static int
+mac_update_vnode_from_extattr(struct vnode *vp, struct mount *mp)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_extattr, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	return (error);
+}
+
+/*
+ * Given an externalized mac label, internalize it and stamp it on a
+ * vnode.
+ */
+static int
+mac_update_vnode_from_externalized(struct vnode *vp, struct mac *extmac)
+{
+	int error;
+
+	MAC_CHECK(update_vnode_from_externalized, vp, &vp->v_label, extmac);
+
+	return (error);
+}
+
+/*
+ * Call out to individual policies to update the label in a vnode from
+ * the mountpoint.
+ */
+void
+mac_update_vnode_from_mount(struct vnode *vp, struct mount *mp)
+{
+
+	MAC_PERFORM(update_vnode_from_mount, vp, &vp->v_label, mp,
+	    &mp->mnt_fslabel);
+
+	if (mac_cache_fslabel_in_vnode)
+		vp->v_flag |= VCACHEDLABEL;
+}
+
+/*
+ * Implementation of VOP_REFRESHLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdrefreshlabel_ea(struct vop_refreshlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct mac extmac;
+	int buflen, error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdrefreshlabel_ea");
+
+	/*
+	 * Call out to external policies first.  Order doesn't really
+	 * matter, as long as failure of one assures failure of all.
+	 */
+	error = mac_update_vnode_from_extattr(vp, vp->v_mount);
+	if (error)
+		return (error);
+
+	buflen = sizeof(extmac);
+	error = vn_extattr_get(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME, &buflen,
+	    (char *)&extmac, curthread);
+	switch (error) {
+	case 0:
+		/* Got it */
+		break;
+
+	case ENOATTR:
+		/*
+		 * Use the label from the mount point.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+
+	case EOPNOTSUPP:
+	default:
+		/* Fail horribly. */
+		return (error);
+	}
+
+	if (buflen != sizeof(extmac))
+		error = EPERM;		/* Fail very closed. */
+	if (error == 0)
+		error = mac_update_vnode_from_externalized(vp, &extmac);
+	if (error == 0)
+		vp->v_flag |= VCACHEDLABEL;
+	else {
+		struct vattr va;
+
+		printf("Corrupted label on %s",
+		    vp->v_mount->mnt_stat.f_mntonname);
+		if (VOP_GETATTR(vp, &va, curthread->td_ucred, curthread) == 0)
+			printf(" inum %ld", va.va_fileid);
+		if (mac_debug_label_fallback) {
+			printf(", falling back.\n");
+			mac_update_vnode_from_mount(vp, vp->v_mount);
+			error = 0;
+		} else {
+			printf(".\n");
+			error = EPERM;
+		}
+	}
+
+	return (error);
+}
+
+/*
+ * Make sure the vnode label is up-to-date.  If EOPNOTSUPP, then we handle
+ * the labeling activity outselves.  Filesystems should be careful not
+ * to change their minds regarding whether they support vop_refreshlabel()
+ * for a vnode or not.  Don't cache the vnode here, allow the file
+ * system code to determine if it's safe to cache.  If we update from
+ * the mount, don't cache since a change to the mount label should affect
+ * all vnodes.
+ */
+static int
+vn_refreshlabel(struct vnode *vp, struct ucred *cred)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vn_refreshlabel");
+
+	if (vp->v_mount == NULL) {
+/*
+		Eventually, we probably want to special-case refreshing
+		of deadfs vnodes, and if there's a lock-free race somewhere,
+		that case might be handled here.
+
+		mac_update_vnode_deadfs(vp);
+		return (0);
+ */
+		/* printf("vn_refreshlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf(
+			    "vn_refreshlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if (vp->v_flag & VCACHEDLABEL) {
+		mac_vnode_label_cache_hits++;
+		return (0);
+	} else
+		mac_vnode_label_cache_misses++;
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		return (0);
+	}
+
+	error = VOP_REFRESHLABEL(vp, cred, curthread);
+	switch (error) {
+	case EOPNOTSUPP:
+		/*
+		 * If labels are not supported on this vnode, fall back to
+		 * the label in the mount and propagate it to the vnode.
+		 * There should probably be some sort of policy/flag/decision
+		 * about doing this.
+		 */
+		mac_update_vnode_from_mount(vp, vp->v_mount);
+		error = 0;
+	default:
+		return (error);
+	}
+}
+
+/*
+ * Helper function for file systems using the vop_std*_ea() calls.  This
+ * function must be called after EA service is available for the vnode,
+ * but before it's hooked up to the namespace so that the node persists
+ * if there's a crash, or before it can be accessed.  On successful
+ * commit of the label to disk (etc), do cache the label.
+ */
+int
+vop_stdcreatevnode_ea(struct vnode *dvp, struct vnode *tvp, struct ucred *cred)
+{
+	struct mac extmac;
+	int error;
+
+	if ((dvp->v_mount->mnt_flag & MNT_MULTILABEL) == 0) {
+		mac_update_vnode_from_mount(tvp, tvp->v_mount);
+	} else {
+		error = vn_refreshlabel(dvp, cred);
+		if (error)
+			return (error);
+
+		/*
+		 * Stick the label in the vnode.  Then try to write to
+		 * disk.  If we fail, return a failure to abort the
+		 * create operation.  Really, this failure shouldn't
+		 * happen except in fairly unusual circumstances (out
+		 * of disk, etc).
+		 */
+		mac_create_vnode(cred, dvp, tvp);
+
+		error = mac_stdcreatevnode_ea(tvp);
+		if (error)
+			return (error);
+
+		/*
+		 * XXX: Eventually this will go away and all policies will
+		 * directly manage their extended attributes.
+		 */
+		error = mac_externalize(&tvp->v_label, &extmac);
+		if (error)
+			return (error);
+
+		error = vn_extattr_set(tvp, IO_NODELOCKED,
+		    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+		    sizeof(extmac), (char *)&extmac, curthread);
+		if (error == 0)
+			tvp->v_flag |= VCACHEDLABEL;
+		else {
+#if 0
+			/*
+			 * In theory, we could have fall-back behavior here.
+			 * It would probably be incorrect.
+			 */
+#endif
+			return (error);
+		}
+	}
+
+	return (0);
+}
+
+void
+mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_execve_transition");
+
+	error = vn_refreshlabel(vp, old);
+	if (error) {
+		printf("mac_execve_transition: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_execve_transition: using old vnode label\n");
+	}
+
+	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label);
+}
+
+int
+mac_execve_will_transition(struct ucred *old, struct vnode *vp)
+{
+	int error, result;
+
+	error = vn_refreshlabel(vp, old);
+	if (error)
+		return (error);
+
+	result = 0;
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label);
+
+	return (result);
+}
+
+static void
+mac_init_label(struct label *label)
+{
+
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_init_structmac(struct mac *mac)
+{
+
+	bzero(mac, sizeof(*mac));
+	mac->m_macflags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_destroy_label(struct label *label)
+{
+
+	KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
+	    ("destroying uninitialized label"));
+
+	bzero(label, sizeof(*label));
+	/* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
+}
+
+int
+mac_init_mbuf(struct mbuf *m, int how)
+{
+	KASSERT(m->m_flags & M_PKTHDR, ("mac_init_mbuf on non-header mbuf"));
+
+	/* "how" is one of M_(TRY|DONT)WAIT */
+	mac_init_label(&m->m_pkthdr.label);
+	MAC_PERFORM(init_mbuf, m, how, &m->m_pkthdr.label);
+	atomic_add_int(&nmacmbufs, 1);
+	return (0);
+}
+
+void
+mac_destroy_mbuf(struct mbuf *m)
+{
+
+	MAC_PERFORM(destroy_mbuf, m, &m->m_pkthdr.label);
+	mac_destroy_label(&m->m_pkthdr.label);
+	atomic_subtract_int(&nmacmbufs, 1);
+}
+
+void
+mac_init_cred(struct ucred *cr)
+{
+
+	mac_init_label(&cr->cr_label);
+	MAC_PERFORM(init_cred, cr, &cr->cr_label);
+	atomic_add_int(&nmaccreds, 1);
+}
+
+void
+mac_destroy_cred(struct ucred *cr)
+{
+
+	MAC_PERFORM(destroy_cred, cr, &cr->cr_label);
+	mac_destroy_label(&cr->cr_label);
+	atomic_subtract_int(&nmaccreds, 1);
+}
+
+void
+mac_init_ifnet(struct ifnet *ifp)
+{
+
+	mac_init_label(&ifp->if_label);
+	MAC_PERFORM(init_ifnet, ifp, &ifp->if_label);
+	atomic_add_int(&nmacifnets, 1);
+}
+
+void
+mac_destroy_ifnet(struct ifnet *ifp)
+{
+
+	MAC_PERFORM(destroy_ifnet, ifp, &ifp->if_label);
+	mac_destroy_label(&ifp->if_label);
+	atomic_subtract_int(&nmacifnets, 1);
+}
+
+void
+mac_init_ipq(struct ipq *ipq)
+{
+
+	mac_init_label(&ipq->ipq_label);
+	MAC_PERFORM(init_ipq, ipq, &ipq->ipq_label);
+	atomic_add_int(&nmacipqs, 1);
+}
+
+void
+mac_destroy_ipq(struct ipq *ipq)
+{
+
+	MAC_PERFORM(destroy_ipq, ipq, &ipq->ipq_label);
+	mac_destroy_label(&ipq->ipq_label);
+	atomic_subtract_int(&nmacipqs, 1);
+}
+
+void
+mac_init_socket(struct socket *socket)
+{
+
+	mac_init_label(&socket->so_label);
+	mac_init_label(&socket->so_peerlabel);
+	MAC_PERFORM(init_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	atomic_add_int(&nmacsockets, 1);
+}
+
+void
+mac_destroy_socket(struct socket *socket)
+{
+
+	MAC_PERFORM(destroy_socket, socket, &socket->so_label,
+	    &socket->so_peerlabel);
+	mac_destroy_label(&socket->so_label);
+	mac_destroy_label(&socket->so_peerlabel);
+	atomic_subtract_int(&nmacsockets, 1);
+}
+
+void
+mac_init_pipe(struct pipe *pipe)
+{
+	struct label *label;
+
+	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
+	mac_init_label(label);
+	pipe->pipe_label = label;
+	pipe->pipe_peer->pipe_label = label;
+	MAC_PERFORM(init_pipe, pipe, pipe->pipe_label);
+	atomic_add_int(&nmacpipes, 1);
+}
+
+void
+mac_destroy_pipe(struct pipe *pipe)
+{
+
+	MAC_PERFORM(destroy_pipe, pipe, pipe->pipe_label);
+	mac_destroy_label(pipe->pipe_label);
+	free(pipe->pipe_label, M_MACPIPELABEL);
+	atomic_subtract_int(&nmacpipes, 1);
+}
+
+void
+mac_init_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	mac_init_label(&bpf_d->bd_label);
+	MAC_PERFORM(init_bpfdesc, bpf_d, &bpf_d->bd_label);
+	atomic_add_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_destroy_bpfdesc(struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(destroy_bpfdesc, bpf_d, &bpf_d->bd_label);
+	mac_destroy_label(&bpf_d->bd_label);
+	atomic_subtract_int(&nmacbpfdescs, 1);
+}
+
+void
+mac_init_mount(struct mount *mp)
+{
+
+	mac_init_label(&mp->mnt_mntlabel);
+	mac_init_label(&mp->mnt_fslabel);
+	MAC_PERFORM(init_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	atomic_add_int(&nmacmounts, 1);
+}
+
+void
+mac_destroy_mount(struct mount *mp)
+{
+
+	MAC_PERFORM(destroy_mount, mp, &mp->mnt_mntlabel, &mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_fslabel);
+	mac_destroy_label(&mp->mnt_mntlabel);
+	atomic_subtract_int(&nmacmounts, 1);
+}
+
+static void
+mac_init_temp(struct label *label)
+{
+
+	mac_init_label(label);
+	MAC_PERFORM(init_temp, label);
+	atomic_add_int(&nmactemp, 1);
+}
+
+static void
+mac_destroy_temp(struct label *label)
+{
+
+	MAC_PERFORM(destroy_temp, label);
+	mac_destroy_label(label);
+	atomic_subtract_int(&nmactemp, 1);
+}
+
+void
+mac_init_vnode(struct vnode *vp)
+{
+
+	mac_init_label(&vp->v_label);
+	MAC_PERFORM(init_vnode, vp, &vp->v_label);
+	atomic_add_int(&nmacvnodes, 1);
+}
+
+void
+mac_destroy_vnode(struct vnode *vp)
+{
+
+	MAC_PERFORM(destroy_vnode, vp, &vp->v_label);
+	mac_destroy_label(&vp->v_label);
+	atomic_subtract_int(&nmacvnodes, 1);
+}
+
+void
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	mac_init_label(&de->de_label);
+	MAC_PERFORM(init_devfsdirent, de, &de->de_label);
+	atomic_add_int(&nmacdevfsdirents, 1);
+}
+
+void
+mac_destroy_devfsdirent(struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(destroy_devfsdirent, de, &de->de_label);
+	mac_destroy_label(&de->de_label);
+	atomic_subtract_int(&nmacdevfsdirents, 1);
+}
+
+static int
+mac_externalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_structmac(mac);
+	MAC_CHECK(externalize, label, mac);
+
+	return (error);
+}
+
+static int
+mac_internalize(struct label *label, struct mac *mac)
+{
+	int error;
+
+	mac_init_temp(label);
+	MAC_CHECK(internalize, label, mac);
+	if (error)
+		mac_destroy_temp(label);
+
+	return (error);
+}
+
+/*
+ * Initialize MAC label for the first kernel process, from which other
+ * kernel processes and threads are spawned.
+ */
+void
+mac_create_proc0(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc0, cred);
+}
+
+/*
+ * Initialize MAC label for the first userland process, from which other
+ * userland processes and threads are spawned.
+ */
+void
+mac_create_proc1(struct ucred *cred)
+{
+
+	MAC_PERFORM(create_proc1, cred);
+}
+
+/*
+ * When a new process is created, its label must be initialized.  Generally,
+ * this involves inheritence from the parent process, modulo possible
+ * deltas.  This function allows that processing to take place.
+ */
+void
+mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
+{
+
+	MAC_PERFORM(create_cred, parent_cred, child_cred);
+}
+
+int
+mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_access");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_chroot");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp, struct vattr *vap)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_create");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	return (error);
+}
+
+int
+mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_delete");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_delete");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+    acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_deleteacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_exec(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	if (!mac_enforce_process && !mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label);
+
+	return (error);
+}
+
+int
+mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	return (error);
+}
+
+int
+mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_getextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+    struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_lookup");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	return (error);
+}
+
+vm_prot_t
+mac_check_vnode_mmap_prot(struct ucred *cred, struct vnode *vp, int newmapping)
+{
+	vm_prot_t result = VM_PROT_ALL;
+
+	/*
+	 * This should be some sort of MAC_BITWISE, maybe :)
+	 */
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_mmap_perms");
+	MAC_BOOLEAN(check_vnode_mmap_perms, &, cred, vp, &vp->v_label,
+	    newmapping);
+	return (result);
+}
+
+int
+mac_check_vnode_op(struct ucred *cred, struct vnode *vp, int op)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_op");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_op, cred, vp, &vp->v_label, op);
+
+	return (error);
+}
+
+int
+mac_check_vnode_open(struct ucred *cred, struct vnode *vp, mode_t acc_mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_open");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	return (error);
+}
+
+int
+mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_readdir");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_readlink");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	return (error);
+}
+
+static int
+mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+    struct label *newlabel)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_from");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_from");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
+	    &vp->v_label, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+    struct vnode *vp, int samedir, struct componentname *cnp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(dvp, "mac_check_vnode_rename_to");
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_rename_to");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(dvp, cred);
+	if (error)
+		return (error);
+	if (vp != NULL) {
+		error = vn_refreshlabel(vp, cred);
+		if (error)
+			return (error);
+	}
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
+	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	return (error);
+}
+
+int
+mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_revoke");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	return (error);
+}
+
+int
+mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
+    struct acl *acl)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setacl");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	return (error);
+}
+
+int
+mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+    int attrnamespace, const char *name, struct uio *uio)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setextattr");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	    attrnamespace, name, uio);
+	return (error);
+}
+
+int
+mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setflags");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	return (error);
+}
+
+int
+mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setmode");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	return (error);
+}
+
+int
+mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
+    gid_t gid)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setowner");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	return (error);
+}
+
+int
+mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+    struct timespec atime, struct timespec mtime)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_setutimes");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	    mtime);
+	return (error);
+}
+
+int
+mac_check_vnode_stat(struct ucred *cred, struct vnode *vp)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_stat");
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	error = vn_refreshlabel(vp, cred);
+	if (error)
+		return (error);
+
+	MAC_CHECK(check_vnode_stat, cred, vp, &vp->v_label);
+	return (error);
+}
+
+/*
+ * When relabeling a process, call out to the policies for the maximum
+ * permission allowed for each object type we know about in its
+ * memory space, and revoke access (in the least surprising ways we
+ * know) when necessary.  The process lock is not held here.
+ */
+static void
+mac_cred_mmapped_drop_perms(struct thread *td, struct ucred *cred)
+{
+
+	/* XXX freeze all other threads */
+	mtx_lock(&Giant);
+	mac_cred_mmapped_drop_perms_recurse(td, cred,
+	    &td->td_proc->p_vmspace->vm_map);
+	mtx_unlock(&Giant);
+	/* XXX allow other threads to continue */
+}
+
+static __inline const char *
+prot2str(vm_prot_t prot)
+{
+
+	switch (prot & VM_PROT_ALL) {
+	case VM_PROT_READ:
+		return ("r--");
+	case VM_PROT_READ | VM_PROT_WRITE:
+		return ("rw-");
+	case VM_PROT_READ | VM_PROT_EXECUTE:
+		return ("r-x");
+	case VM_PROT_READ | VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("rwx");
+	case VM_PROT_WRITE:
+		return ("-w-");
+	case VM_PROT_EXECUTE:
+		return ("--x");
+	case VM_PROT_WRITE | VM_PROT_EXECUTE:
+		return ("-wx");
+	default:
+		return ("---");
+	}
+}
+
+static void
+mac_cred_mmapped_drop_perms_recurse(struct thread *td, struct ucred *cred,
+    struct vm_map *map)
+{
+	struct vm_map_entry *vme;
+	vm_prot_t result, revokeperms;
+	vm_object_t object;
+	vm_ooffset_t offset;
+	struct vnode *vp;
+
+	vm_map_lock_read(map);
+	for (vme = map->header.next; vme != &map->header; vme = vme->next) {
+		if (vme->eflags & MAP_ENTRY_IS_SUB_MAP) {
+			mac_cred_mmapped_drop_perms_recurse(td, cred,
+			    vme->object.sub_map);
+			continue;
+		}
+		/*
+		 * Skip over entries that obviously are not shared.
+		 */
+		if (vme->eflags & (MAP_ENTRY_COW | MAP_ENTRY_NOSYNC) ||
+		    !vme->max_protection)
+			continue;
+		/*
+		 * Drill down to the deepest backing object.
+		 */
+		offset = vme->offset;
+		object = vme->object.vm_object;
+		if (object == NULL)
+			continue;
+		while (object->backing_object != NULL) {
+			object = object->backing_object;
+			offset += object->backing_object_offset;
+		}
+		/*
+		 * At the moment, vm_maps and objects aren't considered
+		 * by the MAC system, so only things with backing by a
+		 * normal object (read: vnodes) are checked.
+		 */
+		if (object->type != OBJT_VNODE)
+			continue;
+		vp = (struct vnode *)object->handle;
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		result = mac_check_vnode_mmap_prot(cred, vp, 0);
+		VOP_UNLOCK(vp, 0, td);
+		/*
+		 * Find out what maximum protection we may be allowing
+		 * now but a policy needs to get removed.
+		 */
+		revokeperms = vme->max_protection & ~result;
+		if (!revokeperms)
+			continue;
+		printf("pid %d: revoking %s perms from %#lx:%d "
+		    "(max %s/cur %s)\n", td->td_proc->p_pid,
+		    prot2str(revokeperms), vme->start, vme->end - vme->start,
+		    prot2str(vme->max_protection), prot2str(vme->protection));
+		vm_map_lock_upgrade(map);
+		/*
+		 * This is the really simple case: if a map has more
+		 * max_protection than is allowed, but it's not being
+		 * actually used (that is, the current protection is
+		 * still allowed), we can just wipe it out and do
+		 * nothing more.
+		 */
+		if ((vme->protection & revokeperms) == 0) {
+			vme->max_protection -= revokeperms;
+		} else {
+			if (revokeperms & VM_PROT_WRITE) {
+				/*
+				 * In the more complicated case, flush out all
+				 * pending changes to the object then turn it
+				 * copy-on-write.
+				 */
+				vm_object_reference(object);
+				vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+				vm_object_page_clean(object,
+				    OFF_TO_IDX(offset),
+				    OFF_TO_IDX(offset + vme->end - vme->start +
+					PAGE_MASK),
+				    OBJPC_SYNC);
+				VOP_UNLOCK(vp, 0, td);
+				vm_object_deallocate(object);
+				/*
+				 * Why bother if there's no read permissions
+				 * anymore?  For the rest, we need to leave
+				 * the write permissions on for COW, or
+				 * remove them entirely if configured to.
+				 */
+				if (!mac_mmap_revocation_via_cow) {
+					vme->max_protection &= ~VM_PROT_WRITE;
+					vme->protection &= ~VM_PROT_WRITE;
+				} if ((revokeperms & VM_PROT_READ) == 0)
+					vme->eflags |= MAP_ENTRY_COW |
+					    MAP_ENTRY_NEEDS_COPY;
+			}
+			if (revokeperms & VM_PROT_EXECUTE) {
+				vme->max_protection &= ~VM_PROT_EXECUTE;
+				vme->protection &= ~VM_PROT_EXECUTE;
+			}
+			if (revokeperms & VM_PROT_READ) {
+				vme->max_protection = 0;
+				vme->protection = 0;
+			}
+			pmap_protect(map->pmap, vme->start, vme->end,
+			    vme->protection & ~revokeperms);
+			vm_map_simplify_entry(map, vme);
+		}
+		vm_map_lock_downgrade(map);
+	}
+	vm_map_unlock_read(map);
+}
+
+/*
+ * When the subject's label changes, it may require revocation of privilege
+ * to mapped objects.  This can't be done on-the-fly later with a unified
+ * buffer cache.
+ */
+static void
+mac_relabel_cred(struct ucred *cred, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_cred, cred, newlabel);
+	mac_cred_mmapped_drop_perms(curthread, cred);
+}
+
+void
+mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+}
+
+void
+mac_create_ifnet(struct ifnet *ifnet)
+{
+
+	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+}
+
+void
+mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
+{
+
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+}
+
+void
+mac_create_socket(struct ucred *cred, struct socket *socket)
+{
+
+	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+}
+
+void
+mac_create_pipe(struct ucred *cred, struct pipe *pipe)
+{
+
+	MAC_PERFORM(create_pipe, cred, pipe, pipe->pipe_label);
+}
+
+void
+mac_create_socket_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
+	    newsocket, &newsocket->so_label);
+}
+
+static void
+mac_relabel_socket(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+}
+
+static void
+mac_relabel_pipe(struct ucred *cred, struct pipe *pipe, struct label *newlabel)
+{
+
+	MAC_PERFORM(relabel_pipe, cred, pipe, pipe->pipe_label, newlabel);
+}
+
+void
+mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, &mbuf->m_pkthdr.label,
+	    socket, &socket->so_peerlabel);
+}
+
+void
+mac_set_socket_peer_from_socket(struct socket *oldsocket,
+    struct socket *newsocket)
+{
+
+	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
+	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+}
+
+void
+mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
+{
+
+	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	    datagram, &datagram->m_pkthdr.label);
+}
+
+void
+mac_create_fragment(struct mbuf *datagram, struct mbuf *fragment)
+{
+
+	MAC_PERFORM(create_fragment, datagram, &datagram->m_pkthdr.label,
+	    fragment, &fragment->m_pkthdr.label);
+}
+
+void
+mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(create_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_mbuf, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
+    struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf,
+	    &oldmbuf->m_pkthdr.label, ifnet, &ifnet->if_label, newmbuf,
+	    &newmbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mbuf_netlayer(struct mbuf *oldmbuf, struct mbuf *newmbuf)
+{
+
+	MAC_PERFORM(create_mbuf_netlayer, oldmbuf, &oldmbuf->m_pkthdr.label,
+	    newmbuf, &newmbuf->m_pkthdr.label);
+}
+
+int
+mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
+{
+	int result;
+
+	result = 1;
+	MAC_BOOLEAN(fragment_match, &&, fragment, &fragment->m_pkthdr.label,
+	    ipq, &ipq->ipq_label);
+
+	return (result);
+}
+
+void
+mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
+{
+
+	MAC_PERFORM(update_ipq, fragment, &fragment->m_pkthdr.label, ipq,
+	    &ipq->ipq_label);
+}
+
+void
+mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
+{
+
+	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+}
+
+void
+mac_create_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+void
+mac_create_root_mount(struct ucred *cred, struct mount *mp)
+{
+
+	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
+	    &mp->mnt_fslabel);
+}
+
+int
+mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
+	    &ifnet->if_label);
+
+	return (error);
+}
+
+static int
+mac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_cred_relabel, cred, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_cred_visible(struct ucred *u1, struct ucred *u2)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_cred_visible, u1, u2);
+
+	return (error);
+}
+
+int
+mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_network)
+		return (0);
+
+	KASSERT(mbuf->m_flags & M_PKTHDR, ("packet has no pkthdr"));
+	if (!(mbuf->m_pkthdr.label.l_flags & MAC_FLAG_INITIALIZED))
+		printf("%s%d: not initialized\n", ifnet->if_name,
+		    ifnet->if_unit);
+
+	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+int
+mac_check_mount_stat(struct ucred *cred, struct mount *mount)
+{
+	int error;
+
+	if (!mac_enforce_fs)
+		return (0);
+
+	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+
+	return (error);
+}
+
+int
+mac_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe, unsigned long cmd,
+    void *data)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_ioctl, cred, pipe, pipe->pipe_label, cmd, data);
+
+	return (error);
+}
+
+int
+mac_check_pipe_op(struct ucred *cred, struct pipe *pipe, int op)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_op, cred, pipe, pipe->pipe_label, op);
+
+	return (error);
+}
+
+static int
+mac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_pipe_relabel, cred, pipe, pipe->pipe_label, newlabel);
+
+	return (error);
+}
+
+int
+mac_check_proc_debug(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_debug, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_sched(struct ucred *cred, struct proc *proc)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_sched, cred, proc);
+
+	return (error);
+}
+
+int
+mac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
+{
+	int error;
+
+	if (!mac_enforce_process)
+		return (0);
+
+	MAC_CHECK(check_proc_signal, cred, proc, signum);
+
+	return (error);
+}
+
+int
+mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_connect(struct ucred *cred, struct socket *socket,
+    struct sockaddr *sockaddr)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	    sockaddr);
+
+	return (error);
+}
+
+int
+mac_check_socket_listen(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	return (error);
+}
+
+int
+mac_check_socket_receive(struct socket *socket, struct mbuf *mbuf)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+
+	MAC_CHECK(check_socket_receive, socket, &socket->so_label, mbuf,
+	    &mbuf->m_pkthdr.label);
+
+	return (error);
+}
+
+static int
+mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
+    struct label *newlabel)
+{
+	int error;
+
+	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	    newlabel);
+
+	return (error);
+}
+
+int
+mac_check_socket_visible(struct ucred *cred, struct socket *socket)
+{
+	int error;
+
+	if (!mac_enforce_socket)
+		return (0);
+                
+	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+                            
+	return (error);
+}
+
+int
+mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac label;
+	int error;
+
+	error = mac_externalize(&ifnet->if_label, &label);
+	if (error)
+		return (error);
+
+	return (copyout(&label, ifr->ifr_ifru.ifru_data, sizeof(label)));
+}
+
+int
+mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
+    struct ifnet *ifnet)
+{
+	struct mac newlabel;
+	struct label intlabel;
+	int error;
+
+	error = copyin(ifr->ifr_ifru.ifru_data, &newlabel, sizeof(newlabel));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &newlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * XXX: Note that this is a redundant privilege check, since
+	 * policies impose this check themselves if required by the
+	 * policy.  Eventually, this should go away.
+	 */
+	error = suser_cred(cred, 0);
+	if (error)
+		goto out;
+
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
+	    &intlabel);
+	if (error)
+		goto out;
+
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+
+out:
+	mac_destroy_temp(&intlabel);
+	return (error);
+}
+
+void
+mac_create_devfs_vnode(struct devfs_dirent *de, struct vnode *vp)
+{
+
+	MAC_PERFORM(create_devfs_vnode, de, &de->de_label, vp, &vp->v_label);
+}
+
+void
+mac_create_devfs_device(dev_t dev, struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_device, dev, de, &de->de_label);
+}
+
+static int
+mac_stdcreatevnode_ea(struct vnode *vp)
+{
+	int error;
+
+	MAC_CHECK(stdcreatevnode_ea, vp, &vp->v_label);
+
+	return (error);
+}
+
+void
+mac_create_devfs_directory(char *dirname, int dirnamelen,
+    struct devfs_dirent *de)
+{
+
+	MAC_PERFORM(create_devfs_directory, dirname, dirnamelen, de,
+	    &de->de_label);
+}
+
+/*
+ * When a new vnode is created, this call will initialize its label.
+ */
+void
+mac_create_vnode(struct ucred *cred, struct vnode *parent,
+    struct vnode *child)
+{
+	int error;
+
+	ASSERT_VOP_LOCKED(parent, "mac_create_vnode");
+	ASSERT_VOP_LOCKED(child, "mac_create_vnode");
+
+	error = vn_refreshlabel(parent, cred);
+	if (error) {
+		printf("mac_create_vnode: vn_refreshlabel returned %d\n",
+		    error);
+		printf("mac_create_vnode: using old vnode label\n");
+	}
+
+	MAC_PERFORM(create_vnode, cred, parent, &parent->v_label, child,
+	    &child->v_label);
+}
+
+int
+mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+	struct label intlabel;
+	int error;
+
+	error = mac_internalize(&intlabel, extmac);
+	if (error)
+		return (error);
+
+	mac_check_socket_relabel(cred, so, &intlabel);
+	if (error) {
+		mac_destroy_temp(&intlabel);
+		return (error);
+	}
+
+	mac_relabel_socket(cred, so, &intlabel);
+
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+int
+mac_pipe_label_set(struct ucred *cred, struct pipe *pipe, struct label *label)
+{
+	int error;
+
+	error = mac_check_pipe_relabel(cred, pipe, label);
+	if (error)
+		return (error);
+
+	mac_relabel_pipe(cred, pipe, label);
+
+	return (0);
+}
+
+int
+mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_label, extmac));
+}
+
+int
+mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
+    struct mac *extmac)
+{
+
+	return (mac_externalize(&so->so_peerlabel, extmac));
+}
+
+/*
+ * Implementation of VOP_SETLABEL() that relies on extended attributes
+ * to store label data.  Can be referenced by filesystems supporting
+ * extended attributes.
+ */
+int
+vop_stdsetlabel_ea(struct vop_setlabel_args *ap)
+{
+	struct vnode *vp = ap->a_vp;
+	struct label *intlabel = ap->a_label;
+	struct mac extmac;
+	int error;
+
+	ASSERT_VOP_LOCKED(vp, "vop_stdsetlabel_ea");
+
+	/*
+	 * XXX: Eventually call out to EA check/set calls here.
+	 * Be particularly careful to avoid race conditions,
+	 * consistency problems, and stability problems when
+	 * dealing with multiple EAs.  In particular, we require
+	 * the ability to write multiple EAs on the same file in
+	 * a single transaction, which the current EA interface
+	 * does not provide.
+	 */
+
+	error = mac_externalize(intlabel, &extmac);
+	if (error)
+		return (error);
+
+	error = vn_extattr_set(vp, IO_NODELOCKED,
+	    FREEBSD_MAC_EXTATTR_NAMESPACE, FREEBSD_MAC_EXTATTR_NAME,
+	    sizeof(extmac), (char *)&extmac, curthread);
+	if (error)
+		return (error);
+
+	mac_relabel_vnode(ap->a_cred, vp, intlabel);
+
+	vp->v_flag |= VCACHEDLABEL;
+
+	return (0);
+}
+
+static int
+vn_setlabel(struct vnode *vp, struct label *intlabel, struct ucred *cred)
+{
+	int error;
+
+	if (vp->v_mount == NULL) {
+		/* printf("vn_setlabel: null v_mount\n"); */
+		if (vp->v_tag != VT_NON)
+			printf("vn_setlabel: null v_mount with non-VT_NON\n");
+		return (EBADF);
+	}
+
+	if ((vp->v_mount->mnt_flag & MNT_MULTILABEL) == 0)
+		return (EOPNOTSUPP);
+
+	/*
+	 * Multi-phase commit.  First check the policies to confirm the
+	 * change is OK.  Then commit via the filesystem.  Finally,
+	 * update the actual vnode label.  Question: maybe the filesystem
+	 * should update the vnode at the end as part of VOP_SETLABEL()?
+	 */
+	error = mac_check_vnode_relabel(cred, vp, intlabel);
+	if (error)
+		return (error);
+
+	/*
+	 * VADMIN provides the opportunity for the filesystem to make
+	 * decisions about who is and is not able to modify labels
+	 * and protections on files.  This might not be right.  We can't
+	 * assume VOP_SETLABEL() will do it, because we might implement
+	 * that as part of vop_stdsetlabel_ea().
+	 */
+	error = VOP_ACCESS(vp, VADMIN, cred, curthread);
+	if (error)
+		return (error);
+
+	error = VOP_SETLABEL(vp, intlabel, cred, curthread);
+	if (error)
+		return (error);
+
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
+{
+	struct mac extmac;
+	int error;
+
+	error = mac_externalize(&td->td_ucred->cr_label, &extmac);
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	return (error);
+}
+
+/*
+ * MPSAFE
+ *
+ * XXX: Needs to be re-written for proc locking.
+ */
+int
+__mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
+{
+	struct ucred *newcred, *oldcred;
+	struct proc *p;
+	struct mac extmac;
+	struct label intlabel;
+	int error;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		return (error);
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		return (error);
+
+	newcred = crget();
+
+	p = td->td_proc;
+	PROC_LOCK(p);
+	oldcred = p->p_ucred;
+
+	error = mac_check_cred_relabel(oldcred, &intlabel);
+	if (error) {
+		PROC_UNLOCK(p);
+		mac_destroy_temp(&intlabel);
+		crfree(newcred);
+		return (error);
+	}
+
+	setsugid(p);
+	crcopy(newcred, oldcred);
+	PROC_UNLOCK(p);
+	mac_relabel_cred(newcred, &intlabel);
+
+	PROC_LOCK(p);
+	p->p_ucred = newcred;
+	PROC_UNLOCK(p);
+	crfree(oldcred);
+	mac_destroy_temp(&intlabel);
+	return (0);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_refreshlabel(vp, td->td_ucred);
+		if (error == 0)
+			error = mac_externalize(&vp->v_label, &extmac);
+		VOP_UNLOCK(vp, 0, td);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_externalize(pipe->pipe_label, &extmac);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+	if (error == 0)
+		error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+	fdrop(fp, td);
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	int error;
+
+	mtx_lock(&Giant);
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out;
+
+	error = vn_refreshlabel(nd.ni_vp, td->td_ucred);
+	if (error == 0)
+		error = mac_externalize(&nd.ni_vp->v_label, &extmac);
+	NDFREE(&nd, 0);
+	if (error)
+		goto out;
+
+	error = copyout(&extmac, SCARG(uap, mac_p), sizeof(extmac));
+
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
+{
+	struct file *fp;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	struct vnode *vp;
+	struct pipe *pipe;
+	int error;
+
+	mtx_lock(&Giant);
+	error = fget(td, SCARG(uap, fd), &fp);
+	if (error)
+		goto out1;
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out2;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out2;
+
+	switch (fp->f_type) {
+	case DTYPE_FIFO:
+	case DTYPE_VNODE:
+		vp = (struct vnode *)fp->f_data;
+		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
+		if (error != 0)
+			break;
+
+		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
+		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		VOP_UNLOCK(vp, 0, td);
+		vn_finished_write(mp);
+		mac_destroy_temp(&intlabel);
+		break;
+	case DTYPE_PIPE:
+		pipe = (struct pipe *)fp->f_data;
+		error = mac_pipe_label_set(td->td_ucred, pipe, &intlabel);
+		break;
+	default:
+		error = EINVAL;
+	}
+
+out2:
+	fdrop(fp, td);
+out1:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+/*
+ * MPSAFE
+ */
+int
+__mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
+{
+	struct nameidata nd;
+	struct mac extmac;
+	struct label intlabel;
+	struct mount *mp;
+	int error;
+
+	mtx_lock(&Giant);
+
+	error = copyin(SCARG(uap, mac_p), &extmac, sizeof(extmac));
+	if (error)
+		goto out;
+
+	error = mac_internalize(&intlabel, &extmac);
+	if (error)
+		goto out;
+
+	NDINIT(&nd, LOOKUP, LOCKLEAF | FOLLOW, UIO_USERSPACE,
+	    SCARG(uap, path_p), td);
+	error = namei(&nd);
+	if (error)
+		goto out2;
+	error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
+	if (error)
+		goto out2;
+
+	error = vn_setlabel(nd.ni_vp, &intlabel, td->td_ucred);
+
+	vn_finished_write(mp);
+out2:
+	mac_destroy_temp(&intlabel);
+	NDFREE(&nd, 0);
+out:
+	mtx_unlock(&Giant);
+	return (error);
+}
+
+SYSINIT(mac, SI_SUB_MAC, SI_ORDER_FIRST, mac_init, NULL);
+SYSINIT(mac_late, SI_SUB_MAC_LATE, SI_ORDER_FIRST, mac_late_init, NULL);
+
+#else /* !MAC */
 
 int
 __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
@@ -91,3 +3105,5 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 
 	return (ENOSYS);
 }
+
+#endif /* !MAC */