Add static DTrace probes for MAC Framework access control checks and

privilege grants so that dtrace can be more easily used to monitor
the security decisions being generated by the MAC Framework following
policy invocation.

Successful access control checks will be reported by:

  mac_framework:kernel:<entrypoint>:mac_check_ok

Failed access control checks will be reported by:

  mac_framework:kernel:<entrypoint>:mac_check_err

Successful privilege grants will be reported by:

  mac_framework:kernel:priv_grant:mac_grant_ok

Failed privilege grants will be reported by:

  mac_framework:kernel:priv_grant:mac_grant_err

In all cases, the return value (always 0 for _ok, otherwise an errno
for _err) will be reported via arg0 on the probe, and subsequent
arguments will hold entrypoint-specific data, in a style similar to
privilege tracing.

Obtained from:	TrustedBSD Project
Sponsored by:	Google, Inc.

17 files changed, 660 insertions, 14 deletions

diff --git a/sys/security/mac/mac_audit.c b/sys/security/mac/mac_audit.c
index f3fc639..6310b04 100644
--- a/sys/security/mac/mac_audit.c
+++ b/sys/security/mac/mac_audit.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
@@ -15,6 +15,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -40,8 +43,13 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
+
 #include <sys/param.h>
+#include <sys/kernel.h>
 #include <sys/module.h>
+#include <sys/queue.h>
+#include <sys/sdt.h>
 #include <sys/vnode.h>
 
 #include <security/audit/audit.h>
@@ -50,46 +58,64 @@ __FBSDID("$FreeBSD$");
 #include <security/mac/mac_internal.h>
 #include <security/mac/mac_policy.h>
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_setaudit, "struct ucred *",
+    "struct auditinfo *");
+
 int
 mac_proc_check_setaudit(struct ucred *cred, struct auditinfo *ai)
 {
 	int error;
 
 	MAC_CHECK(proc_check_setaudit, cred, ai);
+	MAC_CHECK_PROBE2(proc_check_setaudit, error, cred, ai);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_setaudit_addr, "struct ucred *",
+    "struct auditinfo_addr *");
+
 int
 mac_proc_check_setaudit_addr(struct ucred *cred, struct auditinfo_addr *aia)
 {
 	int error;
 
 	MAC_CHECK(proc_check_setaudit_addr, cred, aia);
+	MAC_CHECK_PROBE2(proc_check_setaudit_addr, error, cred, aia);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_setauid, "struct ucred *", "uid_t");
+
 int
 mac_proc_check_setauid(struct ucred *cred, uid_t auid)
 {
 	int error;
 
 	MAC_CHECK(proc_check_setauid, cred, auid);
+	MAC_CHECK_PROBE2(proc_check_setauid, error, cred, auid);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(system_check_audit, "struct ucred *", "void *",
+    "int");
+
 int
 mac_system_check_audit(struct ucred *cred, void *record, int length)
 {
 	int error;
 
 	MAC_CHECK(system_check_audit, cred, record, length);
+	MAC_CHECK_PROBE3(system_check_audit, error, cred, record, length);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(system_check_auditctl, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_system_check_auditctl(struct ucred *cred, struct vnode *vp)
 {
@@ -99,18 +125,21 @@ mac_system_check_auditctl(struct ucred *cred, struct vnode *vp)
 	ASSERT_VOP_LOCKED(vp, "mac_system_check_auditctl");
 
 	vl = (vp != NULL) ? vp->v_label : NULL;
-
 	MAC_CHECK(system_check_auditctl, cred, vp, vl);
+	MAC_CHECK_PROBE2(system_check_auditctl, error, cred, vp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(system_check_auditon, "struct ucred *", "int");
+
 int
 mac_system_check_auditon(struct ucred *cred, int cmd)
 {
 	int error;
 
 	MAC_CHECK(system_check_auditon, cred, cmd);
+	MAC_CHECK_PROBE2(system_check_auditon, error, cred, cmd);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_cred.c b/sys/security/mac/mac_cred.c
index 4d46f9a..8cac7b3 100644
--- a/sys/security/mac/mac_cred.c
+++ b/sys/security/mac/mac_cred.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002, 2008 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2008-2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
  * Copyright (c) 2005 Samy Al Bahra
@@ -18,6 +18,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -43,6 +46,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -55,6 +59,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/proc.h>
 #include <sys/sbuf.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
 #include <sys/mount.h>
@@ -192,22 +197,30 @@ mac_cred_relabel(struct ucred *cred, struct label *newlabel)
 	MAC_PERFORM(cred_relabel, cred, newlabel);
 }
 
+MAC_CHECK_PROBE_DEFINE2(cred_check_relabel, "struct ucred *",
+    "struct label *");
+
 int
 mac_cred_check_relabel(struct ucred *cred, struct label *newlabel)
 {
 	int error;
 
 	MAC_CHECK(cred_check_relabel, cred, newlabel);
+	MAC_CHECK_PROBE2(cred_check_relabel, error, cred, newlabel);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(cred_check_visible, "struct ucred *",
+    "struct ucred *");
+
 int
 mac_cred_check_visible(struct ucred *cr1, struct ucred *cr2)
 {
 	int error;
 
 	MAC_CHECK(cred_check_visible, cr1, cr2);
+	MAC_CHECK_PROBE2(cred_check_visible, error, cr1, cr2);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index c1e2e21..26bdd71 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -85,9 +85,11 @@ __FBSDID("$FreeBSD$");
 #include <security/mac/mac_policy.h>
 
 /*
- * DTrace SDT provider for MAC.
+ * DTrace SDT providers for MAC.
  */
 SDT_PROVIDER_DEFINE(mac);
+SDT_PROVIDER_DEFINE(mac_framework);
+
 SDT_PROBE_DEFINE2(mac, kernel, policy, modevent, "int",
     "struct mac_policy_conf *mpc");
 SDT_PROBE_DEFINE1(mac, kernel, policy, register, "struct mac_policy_conf *");
diff --git a/sys/security/mac/mac_inet.c b/sys/security/mac/mac_inet.c
index b11f5b7..b62938b 100644
--- a/sys/security/mac/mac_inet.c
+++ b/sys/security/mac/mac_inet.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002, 2007 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2007, 2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
@@ -17,6 +17,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -42,6 +45,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -50,6 +54,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/sbuf.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/mount.h>
 #include <sys/file.h>
@@ -298,6 +303,9 @@ mac_ipq_update(struct mbuf *m, struct ipq *q)
 	MAC_PERFORM(ipq_update, m, label, q, q->ipq_label);
 }
 
+MAC_CHECK_PROBE_DEFINE2(inpcb_check_deliver, "struct inpcb *",
+    "struct mbuf *");
+
 int
 mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m)
 {
@@ -309,10 +317,14 @@ mac_inpcb_check_deliver(struct inpcb *inp, struct mbuf *m)
 	label = mac_mbuf_to_label(m);
 
 	MAC_CHECK(inpcb_check_deliver, inp, inp->inp_label, m, label);
+	MAC_CHECK_PROBE2(inpcb_check_deliver, error, inp, m);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(inpcb_check_visible, "struct ucred *",
+    "struct inpcb *");
+
 int
 mac_inpcb_check_visible(struct ucred *cred, struct inpcb *inp)
 {
@@ -321,6 +333,7 @@ mac_inpcb_check_visible(struct ucred *cred, struct inpcb *inp)
 	INP_LOCK_ASSERT(inp);
 
 	MAC_CHECK(inpcb_check_visible, cred, inp, inp->inp_label);
+	MAC_CHECK_PROBE2(inpcb_check_visible, error, cred, inp);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 79544c3..34336fc 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002, 2006 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2006, 2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
  * Copyright (c) 2006 nCircle Network Security, Inc.
@@ -21,6 +21,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -60,6 +63,72 @@ SYSCTL_DECL(_security_mac);
 #endif /* SYSCTL_DECL */
 
 /*
+ * MAC Framework SDT DTrace probe namespace, macros for declaring entry
+ * point probes, macros for invoking them.
+ */
+#ifdef SDT_PROVIDER_DECLARE
+SDT_PROVIDER_DECLARE(mac);		/* MAC Framework-level events. */
+SDT_PROVIDER_DECLARE(mac_framework);	/* Entry points to MAC. */
+
+#define	MAC_CHECK_PROBE_DEFINE4(name, arg0, arg1, arg2, arg3)		\
+	SDT_PROBE_DEFINE5(mac_framework, kernel, name, mac_check_err,	\
+	    "int", arg0, arg1, arg2, arg3);				\
+	SDT_PROBE_DEFINE5(mac_framework, kernel, name, mac_check_ok,	\
+	    "int", arg0, arg1, arg2, arg3);
+
+#define	MAC_CHECK_PROBE_DEFINE3(name, arg0, arg1, arg2)			\
+	SDT_PROBE_DEFINE4(mac_framework, kernel, name, mac_check_err,	\
+	    "int", arg0, arg1, arg2);					\
+	SDT_PROBE_DEFINE4(mac_framework, kernel, name, mac_check_ok,	\
+	    "int", arg0, arg1, arg2);
+
+#define	MAC_CHECK_PROBE_DEFINE2(name, arg0, arg1)			\
+	SDT_PROBE_DEFINE3(mac_framework, kernel, name, mac_check_err,	\
+	    "int", arg0, arg1);						\
+	SDT_PROBE_DEFINE3(mac_framework, kernel, name, mac_check_ok,	\
+	    "int", arg0, arg1);
+
+#define	MAC_CHECK_PROBE_DEFINE1(name, arg0)				\
+	SDT_PROBE_DEFINE2(mac_framework, kernel, name, mac_check_err,	\
+	    "int", arg0);						\
+	SDT_PROBE_DEFINE2(mac_framework, kernel, name, mac_check_ok,	\
+	    "int", arg0);
+
+#define	MAC_CHECK_PROBE4(name, error, arg0, arg1, arg2, arg3)	do {	\
+	if (error) {							\
+		SDT_PROBE(mac_framework, kernel, name, mac_check_err,	\
+		    error, arg0, arg1, arg2, arg3);			\
+	} else {							\
+		SDT_PROBE(mac_framework, kernel, name, mac_check_ok,	\
+		    0, arg0, arg1, arg2, arg3);				\
+	}								\
+} while (0)
+
+#define	MAC_CHECK_PROBE3(name, error, arg0, arg1, arg2)			\
+	MAC_CHECK_PROBE4(name, error, arg0, arg1, arg2, 0)
+#define	MAC_CHECK_PROBE2(name, error, arg0, arg1)			\
+	MAC_CHECK_PROBE3(name, error, arg0, arg1, 0)
+#define	MAC_CHECK_PROBE1(name, error, arg0)				\
+	MAC_CHECK_PROBE2(name, error, arg0, 0)
+#endif
+
+#define	MAC_GRANT_PROBE_DEFINE2(name, arg0, arg1)			\
+	SDT_PROBE_DEFINE3(mac_framework, kernel, name, mac_grant_err,	\
+	    "int", arg0, arg1);						\
+	SDT_PROBE_DEFINE3(mac_framework, kernel, name, mac_grant_ok,	\
+	    "INT", arg0, arg1);
+
+#define	MAC_GRANT_PROBE2(name, error, arg0, arg1)	do {		\
+	if (error) {							\
+		SDT_PROBE(mac_framework, kernel, name, mac_grant_err,	\
+		    error, arg0, arg1, 0, 0);				\
+	} else {							\
+		SDT_PROBE(mac_framework, kernel, name, mac_grant_ok,	\
+		    error, arg0, arg1, 0, 0);				\
+	}								\
+} while (0)
+
+/*
  * MAC Framework global types and typedefs.
  */
 LIST_HEAD(mac_policy_list_head, mac_policy_conf);
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 8e8afea..4fccbd7 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2004 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
@@ -17,6 +17,9 @@
  * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
  * as part of the DARPA CHATS research program.
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -42,6 +45,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -52,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/priv.h>
 #include <sys/sbuf.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/mount.h>
 #include <sys/file.h>
@@ -324,6 +329,9 @@ mac_ifnet_create_mbuf(struct ifnet *ifp, struct mbuf *m)
 	MAC_IFNET_UNLOCK(ifp);
 }
 
+MAC_CHECK_PROBE_DEFINE2(bpfdesc_check_receive, "struct bpf_d *",
+    "struct ifnet *");
+
 int
 mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp)
 {
@@ -333,11 +341,15 @@ mac_bpfdesc_check_receive(struct bpf_d *d, struct ifnet *ifp)
 
 	MAC_IFNET_LOCK(ifp);
 	MAC_CHECK(bpfdesc_check_receive, d, d->bd_label, ifp, ifp->if_label);
+	MAC_CHECK_PROBE2(bpfdesc_check_receive, error, d, ifp);
 	MAC_IFNET_UNLOCK(ifp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(ifnet_check_transmit, "struct ifnet *",
+    "struct mbuf *");
+
 int
 mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m)
 {
@@ -350,6 +362,7 @@ mac_ifnet_check_transmit(struct ifnet *ifp, struct mbuf *m)
 
 	MAC_IFNET_LOCK(ifp);
 	MAC_CHECK(ifnet_check_transmit, ifp, ifp->if_label, m, label);
+	MAC_CHECK_PROBE2(ifnet_check_transmit, error, ifp, m);
 	MAC_IFNET_UNLOCK(ifp);
 
 	return (error);
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 1d8ce04..921fd20 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -1,6 +1,7 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
+ * Copyright (c) 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project in part by Network
@@ -11,6 +12,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -36,6 +40,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -45,6 +50,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/module.h>
 #include <sys/mutex.h>
 #include <sys/sbuf.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
 #include <sys/pipe.h>
@@ -135,6 +141,9 @@ mac_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	MAC_PERFORM(pipe_relabel, cred, pp, pp->pp_label, newlabel);
 }
 
+MAC_CHECK_PROBE_DEFINE4(pipe_check_ioctl, "struct ucred *",
+    "struct pipepair *", "unsigned long", "void *");
+
 int
 mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
     unsigned long cmd, void *data)
@@ -144,10 +153,14 @@ mac_pipe_check_ioctl(struct ucred *cred, struct pipepair *pp,
 	mtx_assert(&pp->pp_mtx, MA_OWNED);
 
 	MAC_CHECK(pipe_check_ioctl, cred, pp, pp->pp_label, cmd, data);
+	MAC_CHECK_PROBE4(pipe_check_ioctl, error, cred, pp, cmd, data);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(pipe_check_poll, "struct ucred *",
+    "struct pipepair *");
+
 int
 mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp)
 {
@@ -156,10 +169,14 @@ mac_pipe_check_poll(struct ucred *cred, struct pipepair *pp)
 	mtx_assert(&pp->pp_mtx, MA_OWNED);
 
 	MAC_CHECK(pipe_check_poll, cred, pp, pp->pp_label);
+	MAC_CHECK_PROBE2(pipe_check_poll, error, cred, pp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(pipe_check_read, "struct ucred *",
+    "struct pipepair *");
+
 int
 mac_pipe_check_read(struct ucred *cred, struct pipepair *pp)
 {
@@ -168,10 +185,14 @@ mac_pipe_check_read(struct ucred *cred, struct pipepair *pp)
 	mtx_assert(&pp->pp_mtx, MA_OWNED);
 
 	MAC_CHECK(pipe_check_read, cred, pp, pp->pp_label);
+	MAC_CHECK_PROBE2(pipe_check_read, error, cred, pp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(pipe_check_relabel, "struct ucred *",
+    "struct pipepair *", "struct label *");
+
 static int
 mac_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
     struct label *newlabel)
@@ -181,10 +202,14 @@ mac_pipe_check_relabel(struct ucred *cred, struct pipepair *pp,
 	mtx_assert(&pp->pp_mtx, MA_OWNED);
 
 	MAC_CHECK(pipe_check_relabel, cred, pp, pp->pp_label, newlabel);
+	MAC_CHECK_PROBE3(pipe_check_relabel, error, cred, pp, newlabel);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(pipe_check_stat, "struct ucred *",
+    "struct pipepair *");
+
 int
 mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp)
 {
@@ -193,10 +218,14 @@ mac_pipe_check_stat(struct ucred *cred, struct pipepair *pp)
 	mtx_assert(&pp->pp_mtx, MA_OWNED);
 
 	MAC_CHECK(pipe_check_stat, cred, pp, pp->pp_label);
+	MAC_CHECK_PROBE2(pipe_check_stat, error, cred, pp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(pipe_check_write, "struct ucred *",
+    "struct pipepair *");
+
 int
 mac_pipe_check_write(struct ucred *cred, struct pipepair *pp)
 {
@@ -205,6 +234,7 @@ mac_pipe_check_write(struct ucred *cred, struct pipepair *pp)
 	mtx_assert(&pp->pp_mtx, MA_OWNED);
 
 	MAC_CHECK(pipe_check_write, cred, pp, pp->pp_label);
+	MAC_CHECK_PROBE2(pipe_check_write, error, cred, pp);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_posix_sem.c b/sys/security/mac/mac_posix_sem.c
index 1cda22c..2e3560d 100644
--- a/sys/security/mac/mac_posix_sem.c
+++ b/sys/security/mac/mac_posix_sem.c
@@ -1,5 +1,6 @@
 /*-
  * Copyright (c) 2003-2006 SPARTA, Inc.
+ * Copyright (c) 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project in part by Network
@@ -10,6 +11,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -35,6 +39,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 #include "opt_posix.h"
 
@@ -43,6 +48,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/ksem.h>
 #include <sys/malloc.h>
 #include <sys/module.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/sysctl.h>
 
@@ -95,16 +101,23 @@ mac_posixsem_create(struct ucred *cred, struct ksem *ks)
 	MAC_PERFORM(posixsem_create, cred, ks, ks->ks_label);
 }
 
+MAC_CHECK_PROBE_DEFINE2(posixsem_check_open, "struct ucred *",
+    "struct ksem *");
+
 int
 mac_posixsem_check_open(struct ucred *cred, struct ksem *ks)
 {
 	int error;
 
 	MAC_CHECK(posixsem_check_open, cred, ks, ks->ks_label);
+	MAC_CHECK_PROBE2(posixsem_check_open, error, cred, ks);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(posixsem_check_getvalue, "struct ucred *",
+    "struct ucred *", "struct ksem *");
+
 int
 mac_posixsem_check_getvalue(struct ucred *active_cred, struct ucred *file_cred,
     struct ksem *ks)
@@ -113,10 +126,15 @@ mac_posixsem_check_getvalue(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(posixsem_check_getvalue, active_cred, file_cred, ks,
 	    ks->ks_label);
+	MAC_CHECK_PROBE3(posixsem_check_getvalue, error, active_cred,
+	    file_cred, ks);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(posixsem_check_post, "struct ucred *",
+    "struct ucred *", "struct ksem *");
+
 int
 mac_posixsem_check_post(struct ucred *active_cred, struct ucred *file_cred,
     struct ksem *ks)
@@ -125,10 +143,15 @@ mac_posixsem_check_post(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(posixsem_check_post, active_cred, file_cred, ks,
 	    ks->ks_label);
+	MAC_CHECK_PROBE3(posixsem_check_post, error, active_cred, file_cred,
+	    ks);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(posixsem_check_stat, "struct ucred *",
+    "struct ucred *", "struct ksem *");
+
 int
 mac_posixsem_check_stat(struct ucred *active_cred, struct ucred *file_cred,
     struct ksem *ks)
@@ -137,20 +160,29 @@ mac_posixsem_check_stat(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(posixsem_check_stat, active_cred, file_cred, ks,
 	    ks->ks_label);
+	MAC_CHECK_PROBE3(posixsem_check_stat, error, active_cred, file_cred,
+	    ks);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(posixsem_check_unlink, "struct ucred *",
+    "struct ksem *");
+
 int
 mac_posixsem_check_unlink(struct ucred *cred, struct ksem *ks)
 {
 	int error;
 
 	MAC_CHECK(posixsem_check_unlink, cred, ks, ks->ks_label);
+	MAC_CHECK_PROBE2(posixsem_check_unlink, error, cred, ks);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(posixsem_check_wait, "struct ucred *",
+    "struct ucred *", "struct ksem *");
+
 int
 mac_posixsem_check_wait(struct ucred *active_cred, struct ucred *file_cred,
     struct ksem *ks)
@@ -159,6 +191,8 @@ mac_posixsem_check_wait(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(posixsem_check_wait, active_cred, file_cred, ks,
 	    ks->ks_label);
+	MAC_CHECK_PROBE3(posixsem_check_wait, error, active_cred, file_cred,
+	    ks);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_posix_shm.c b/sys/security/mac/mac_posix_shm.c
index 97587ad..913cb43 100644
--- a/sys/security/mac/mac_posix_shm.c
+++ b/sys/security/mac/mac_posix_shm.c
@@ -1,5 +1,6 @@
 /*-
  * Copyright (c) 2003-2006 SPARTA, Inc.
+ * Copyright (c) 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project in part by Network
@@ -8,7 +9,10 @@
  * as part of the DARPA CHATS research program.
  *
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
- * N66001-04-C-6019 ("SEFOS").
+ * N66001-04-C-6019 ("SEFOS"). *
+ *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +39,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -42,6 +47,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mman.h>
 #include <sys/malloc.h>
 #include <sys/module.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/sysctl.h>
 
@@ -94,6 +100,9 @@ mac_posixshm_create(struct ucred *cred, struct shmfd *shmfd)
 	MAC_PERFORM(posixshm_create, cred, shmfd, shmfd->shm_label);
 }
 
+MAC_CHECK_PROBE_DEFINE4(posixshm_check_mmap, "struct ucred *",
+    "struct shmfd *", "int", "int");
+
 int
 mac_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd, int prot,
     int flags)
@@ -102,20 +111,29 @@ mac_posixshm_check_mmap(struct ucred *cred, struct shmfd *shmfd, int prot,
 
 	MAC_CHECK(posixshm_check_mmap, cred, shmfd, shmfd->shm_label, prot,
 	    flags);
+	MAC_CHECK_PROBE4(posixshm_check_mmap, error, cred, shmfd, prot,
+	    flags);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(posixshm_check_open, "struct ucred *",
+    "struct shmfd *");
+
 int
 mac_posixshm_check_open(struct ucred *cred, struct shmfd *shmfd)
 {
 	int error;
 
 	MAC_CHECK(posixshm_check_open, cred, shmfd, shmfd->shm_label);
+	MAC_CHECK_PROBE2(posixshm_check_open, error, cred, shmfd);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(posixshm_check_stat, "struct ucred *",
+    "struct ucred *", "struct shmfd *");
+
 int
 mac_posixshm_check_stat(struct ucred *active_cred, struct ucred *file_cred,
     struct shmfd *shmfd)
@@ -124,10 +142,15 @@ mac_posixshm_check_stat(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(posixshm_check_stat, active_cred, file_cred, shmfd,
 	    shmfd->shm_label);
+	MAC_CHECK_PROBE3(posixshm_check_stat, error, active_cred, file_cred,
+	    shmfd);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(posixshm_check_truncate, "struct ucred *",
+    "struct ucred *", "struct shmfd *");
+
 int
 mac_posixshm_check_truncate(struct ucred *active_cred, struct ucred *file_cred,
     struct shmfd *shmfd)
@@ -136,16 +159,22 @@ mac_posixshm_check_truncate(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(posixshm_check_truncate, active_cred, file_cred, shmfd,
 	    shmfd->shm_label);
+	MAC_CHECK_PROBE3(posixshm_check_truncate, error, active_cred,
+	    file_cred, shmfd);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(posixshm_check_unlink, "struct ucred *",
+    "struct shmfd *");
+
 int
 mac_posixshm_check_unlink(struct ucred *cred, struct shmfd *shmfd)
 {
 	int error;
 
 	MAC_CHECK(posixshm_check_unlink, cred, shmfd, shmfd->shm_label);
+	MAC_CHECK_PROBE2(posixshm_check_unlink, error, cred, shmfd);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_priv.c b/sys/security/mac/mac_priv.c
index 745695c..f12b020 100644
--- a/sys/security/mac/mac_priv.c
+++ b/sys/security/mac/mac_priv.c
@@ -1,10 +1,14 @@
 /*-
  * Copyright (c) 2006 nCircle Network Security, Inc.
+ * Copyright (c) 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed by Robert N. M. Watson for the TrustedBSD
  * Project under contract to nCircle Network Security, Inc.
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -34,10 +38,13 @@
 #include "sys/cdefs.h"
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
+#include <sys/kernel.h>
 #include <sys/priv.h>
+#include <sys/sdt.h>
 #include <sys/module.h>
 
 #include <security/mac/mac_framework.h>
@@ -54,6 +61,8 @@ __FBSDID("$FreeBSD$");
  * composition.
  */
 
+MAC_CHECK_PROBE_DEFINE2(priv_check, "struct ucred *", "int");
+
 /*
  * Restrict access to a privilege for a credential.  Return failure if any
  * policy denies access.
@@ -64,10 +73,13 @@ mac_priv_check(struct ucred *cred, int priv)
 	int error;
 
 	MAC_CHECK(priv_check, cred, priv);
+	MAC_CHECK_PROBE2(priv_check, error, cred, priv);
 
 	return (error);
 }
 
+MAC_GRANT_PROBE_DEFINE2(priv_grant, "struct ucred *", "int");
+
 /*
  * Grant access to a privilege for a credential.  Return success if any
  * policy grants access.
@@ -78,6 +90,7 @@ mac_priv_grant(struct ucred *cred, int priv)
 	int error;
 
 	MAC_GRANT(priv_grant, cred, priv);
+	MAC_GRANT_PROBE2(priv_grant, error, cred, priv);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index fe8c397..0a98585 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002, 2008 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2008-2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2003 Networks Associates Technology, Inc.
  * Copyright (c) 2005 Samy Al Bahra
@@ -18,6 +18,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -43,6 +46,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -55,6 +59,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/proc.h>
 #include <sys/sbuf.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
 #include <sys/mount.h>
@@ -373,6 +378,8 @@ mac_proc_vm_revoke_recurse(struct thread *td, struct ucred *cred,
 	vm_map_unlock(map);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_debug, "struct ucred *", "struct proc *");
+
 int
 mac_proc_check_debug(struct ucred *cred, struct proc *p)
 {
@@ -381,10 +388,13 @@ mac_proc_check_debug(struct ucred *cred, struct proc *p)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_debug, cred, p);
+	MAC_CHECK_PROBE2(proc_check_debug, error, cred, p);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_sched, "struct ucred *", "struct proc *");
+
 int
 mac_proc_check_sched(struct ucred *cred, struct proc *p)
 {
@@ -393,10 +403,14 @@ mac_proc_check_sched(struct ucred *cred, struct proc *p)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_sched, cred, p);
+	MAC_CHECK_PROBE2(proc_check_sched, error, cred, p);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(proc_check_signal, "struct ucred *", "struct proc *",
+    "int");
+
 int
 mac_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
 {
@@ -405,10 +419,13 @@ mac_proc_check_signal(struct ucred *cred, struct proc *p, int signum)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_signal, cred, p, signum);
+	MAC_CHECK_PROBE3(proc_check_signal, error, cred, p, signum);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_setuid, "struct ucred *", "uid_t");
+
 int
 mac_proc_check_setuid(struct proc *p, struct ucred *cred, uid_t uid)
 {
@@ -417,9 +434,13 @@ mac_proc_check_setuid(struct proc *p, struct ucred *cred, uid_t uid)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_setuid, cred, uid);
+	MAC_CHECK_PROBE2(proc_check_setuid, error, cred, uid);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_seteuid, "struct ucred *", "uid_t");
+
 int
 mac_proc_check_seteuid(struct proc *p, struct ucred *cred, uid_t euid)
 {
@@ -428,9 +449,13 @@ mac_proc_check_seteuid(struct proc *p, struct ucred *cred, uid_t euid)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_seteuid, cred, euid);
+	MAC_CHECK_PROBE2(proc_check_seteuid, error, cred, euid);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_setgid, "struct ucred *", "gid_t");
+
 int
 mac_proc_check_setgid(struct proc *p, struct ucred *cred, gid_t gid)
 {
@@ -439,10 +464,13 @@ mac_proc_check_setgid(struct proc *p, struct ucred *cred, gid_t gid)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_setgid, cred, gid);
+	MAC_CHECK_PROBE2(proc_check_setgid, error, cred, gid);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_setegid, "struct ucred *", "gid_t");
+
 int
 mac_proc_check_setegid(struct proc *p, struct ucred *cred, gid_t egid)
 {
@@ -451,10 +479,14 @@ mac_proc_check_setegid(struct proc *p, struct ucred *cred, gid_t egid)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_setegid, cred, egid);
+	MAC_CHECK_PROBE2(proc_check_setegid, error, cred, egid);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(proc_check_setgroups, "struct ucred *", "int",
+    "gid_t *");
+
 int
 mac_proc_check_setgroups(struct proc *p, struct ucred *cred, int ngroups,
     gid_t *gidset)
@@ -464,9 +496,14 @@ mac_proc_check_setgroups(struct proc *p, struct ucred *cred, int ngroups,
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_setgroups, cred, ngroups, gidset);
+	MAC_CHECK_PROBE3(proc_check_setgroups, error, cred, ngroups, gidset);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(proc_check_setreuid, "struct ucred *", "uid_t",
+    "uid_t");
+
 int
 mac_proc_check_setreuid(struct proc *p, struct ucred *cred, uid_t ruid,
     uid_t euid)
@@ -476,10 +513,14 @@ mac_proc_check_setreuid(struct proc *p, struct ucred *cred, uid_t ruid,
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_setreuid, cred, ruid, euid);
+	MAC_CHECK_PROBE3(proc_check_setreuid, error, cred, ruid, euid);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(proc_check_setregid, "struct ucred *", "gid_t",
+    "gid_t");
+
 int
 mac_proc_check_setregid(struct proc *proc, struct ucred *cred, gid_t rgid,
     gid_t egid)
@@ -489,10 +530,14 @@ mac_proc_check_setregid(struct proc *proc, struct ucred *cred, gid_t rgid,
 	PROC_LOCK_ASSERT(proc, MA_OWNED);
 
 	MAC_CHECK(proc_check_setregid, cred, rgid, egid);
+	MAC_CHECK_PROBE3(proc_check_setregid, error, cred, rgid, egid);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(proc_check_setresuid, "struct ucred *", "uid_t",
+    "uid_t", "uid_t");
+
 int
 mac_proc_check_setresuid(struct proc *p, struct ucred *cred, uid_t ruid,
     uid_t euid, uid_t suid)
@@ -502,9 +547,15 @@ mac_proc_check_setresuid(struct proc *p, struct ucred *cred, uid_t ruid,
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_setresuid, cred, ruid, euid, suid);
+	MAC_CHECK_PROBE4(proc_check_setresuid, error, cred, ruid, euid,
+	    suid);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(proc_check_setresgid, "struct ucred *", "gid_t",
+    "gid_t", "gid_t");
+
 int
 mac_proc_check_setresgid(struct proc *p, struct ucred *cred, gid_t rgid,
     gid_t egid, gid_t sgid)
@@ -514,10 +565,14 @@ mac_proc_check_setresgid(struct proc *p, struct ucred *cred, gid_t rgid,
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_setresgid, cred, rgid, egid, sgid);
+	MAC_CHECK_PROBE4(proc_check_setresgid, error, cred, rgid, egid,
+	    sgid);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(proc_check_wait, "struct ucred *", "struct proc *");
+
 int
 mac_proc_check_wait(struct ucred *cred, struct proc *p)
 {
@@ -526,6 +581,7 @@ mac_proc_check_wait(struct ucred *cred, struct proc *p)
 	PROC_LOCK_ASSERT(p, MA_OWNED);
 
 	MAC_CHECK(proc_check_wait, cred, p);
+	MAC_CHECK_PROBE2(proc_check_wait, error, cred, p);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_socket.c b/sys/security/mac/mac_socket.c
index fe297ce..fa4a970 100644
--- a/sys/security/mac/mac_socket.c
+++ b/sys/security/mac/mac_socket.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
  * Copyright (c) 2005-2006 SPARTA, Inc.
@@ -17,6 +17,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -42,6 +45,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -51,6 +55,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mutex.h>
 #include <sys/mac.h>
 #include <sys/sbuf.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/mount.h>
 #include <sys/file.h>
@@ -276,6 +281,9 @@ mac_socket_create_mbuf(struct socket *so, struct mbuf *m)
 	MAC_PERFORM(socket_create_mbuf, so, so->so_label, m, label);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_accept, "struct ucred *",
+    "struct socket *");
+
 int
 mac_socket_check_accept(struct ucred *cred, struct socket *so)
 {
@@ -284,10 +292,14 @@ mac_socket_check_accept(struct ucred *cred, struct socket *so)
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_accept, cred, so, so->so_label);
+	MAC_CHECK_PROBE2(socket_check_accept, error, cred, so);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(socket_check_bind, "struct ucred *",
+    "struct socket *", "struct sockaddr *");
+
 int
 mac_socket_check_bind(struct ucred *ucred, struct socket *so,
     struct sockaddr *sa)
@@ -297,10 +309,14 @@ mac_socket_check_bind(struct ucred *ucred, struct socket *so,
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_bind, ucred, so, so->so_label, sa);
+	MAC_CHECK_PROBE3(socket_check_bind, error, ucred, so, sa);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(socket_check_connect, "struct ucred *",
+    "struct socket *", "struct sockaddr *");
+
 int
 mac_socket_check_connect(struct ucred *cred, struct socket *so,
     struct sockaddr *sa)
@@ -310,20 +326,29 @@ mac_socket_check_connect(struct ucred *cred, struct socket *so,
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_connect, cred, so, so->so_label, sa);
+	MAC_CHECK_PROBE3(socket_check_connect, error, cred, so, sa);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(socket_check_create, "struct ucred *", "int", "int",
+    "int");
+
 int
 mac_socket_check_create(struct ucred *cred, int domain, int type, int proto)
 {
 	int error;
 
 	MAC_CHECK(socket_check_create, cred, domain, type, proto);
+	MAC_CHECK_PROBE4(socket_check_create, error, cred, domain, type,
+	    proto);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_deliver, "struct socket *",
+    "struct mbuf *");
+
 int
 mac_socket_check_deliver(struct socket *so, struct mbuf *m)
 {
@@ -335,10 +360,14 @@ mac_socket_check_deliver(struct socket *so, struct mbuf *m)
 	label = mac_mbuf_to_label(m);
 
 	MAC_CHECK(socket_check_deliver, so, so->so_label, m, label);
+	MAC_CHECK_PROBE2(socket_check_deliver, error, so, m);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_listen, "struct ucred *",
+    "struct socket *");
+
 int
 mac_socket_check_listen(struct ucred *cred, struct socket *so)
 {
@@ -347,10 +376,14 @@ mac_socket_check_listen(struct ucred *cred, struct socket *so)
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_listen, cred, so, so->so_label);
+	MAC_CHECK_PROBE2(socket_check_listen, error, cred, so);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_poll, "struct ucred *",
+    "struct socket *");
+
 int
 mac_socket_check_poll(struct ucred *cred, struct socket *so)
 {
@@ -359,10 +392,14 @@ mac_socket_check_poll(struct ucred *cred, struct socket *so)
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_poll, cred, so, so->so_label);
+	MAC_CHECK_PROBE2(socket_check_poll, error, cred, so);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_receive, "struct ucred *",
+    "struct socket *");
+
 int
 mac_socket_check_receive(struct ucred *cred, struct socket *so)
 {
@@ -371,10 +408,14 @@ mac_socket_check_receive(struct ucred *cred, struct socket *so)
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_receive, cred, so, so->so_label);
+	MAC_CHECK_PROBE2(socket_check_receive, error, cred, so);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(socket_check_relabel, "struct ucred *",
+    "struct socket *", "struct label *");
+
 static int
 mac_socket_check_relabel(struct ucred *cred, struct socket *so,
     struct label *newlabel)
@@ -384,10 +425,14 @@ mac_socket_check_relabel(struct ucred *cred, struct socket *so,
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_relabel, cred, so, so->so_label, newlabel);
+	MAC_CHECK_PROBE3(socket_check_relabel, error, cred, so, newlabel);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_send, "struct ucred *",
+    "struct socket *");
+
 int
 mac_socket_check_send(struct ucred *cred, struct socket *so)
 {
@@ -396,10 +441,14 @@ mac_socket_check_send(struct ucred *cred, struct socket *so)
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_send, cred, so, so->so_label);
+	MAC_CHECK_PROBE2(socket_check_send, error, cred, so);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_stat, "struct ucred *",
+    "struct socket *");
+
 int
 mac_socket_check_stat(struct ucred *cred, struct socket *so)
 {
@@ -408,10 +457,14 @@ mac_socket_check_stat(struct ucred *cred, struct socket *so)
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_stat, cred, so, so->so_label);
+	MAC_CHECK_PROBE2(socket_check_stat, error, cred, so);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(socket_check_visible, "struct ucred *",
+    "struct socket *");
+
 int
 mac_socket_check_visible(struct ucred *cred, struct socket *so)
 {
@@ -420,6 +473,7 @@ mac_socket_check_visible(struct ucred *cred, struct socket *so)
 	SOCK_LOCK_ASSERT(so);
 
 	MAC_CHECK(socket_check_visible, cred, so, so->so_label);
+	MAC_CHECK_PROBE2(socket_check_visible, error, cred, so);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 588e019..a8e351e 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -1,7 +1,7 @@
 /*-
  * Copyright (c) 2002-2003 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
- * Copyright (c) 2007 Robert N. M. Watson
+ * Copyright (c) 2007, 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project in part by Network
@@ -15,6 +15,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -50,6 +53,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -58,6 +62,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/malloc.h>
 #include <sys/module.h>
 #include <sys/mutex.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
 #include <sys/sysctl.h>
@@ -66,46 +71,61 @@ __FBSDID("$FreeBSD$");
 #include <security/mac/mac_internal.h>
 #include <security/mac/mac_policy.h>
 
+MAC_CHECK_PROBE_DEFINE1(kenv_check_dump, "struct ucred *");
+
 int
 mac_kenv_check_dump(struct ucred *cred)
 {
 	int error;
 
 	MAC_CHECK(kenv_check_dump, cred);
+	MAC_CHECK_PROBE1(kenv_check_dump, error, cred);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(kenv_check_get, "struct ucred *", "char *");
+
 int
 mac_kenv_check_get(struct ucred *cred, char *name)
 {
 	int error;
 
 	MAC_CHECK(kenv_check_get, cred, name);
+	MAC_CHECK_PROBE2(kenv_check_get, error, cred, name);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(kenv_check_set, "struct ucred *", "char *",
+    "char *");
+
 int
 mac_kenv_check_set(struct ucred *cred, char *name, char *value)
 {
 	int error;
 
 	MAC_CHECK(kenv_check_set, cred, name, value);
+	MAC_CHECK_PROBE3(kenv_check_set, error, cred, name, value);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(kenv_check_unset, "struct ucred *", "char *");
+
 int
 mac_kenv_check_unset(struct ucred *cred, char *name)
 {
 	int error;
 
 	MAC_CHECK(kenv_check_unset, cred, name);
+	MAC_CHECK_PROBE2(kenv_check_unset, error, cred, name);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(kld_check_load, "struct ucred *", "struct vnode *");
+
 int
 mac_kld_check_load(struct ucred *cred, struct vnode *vp)
 {
@@ -114,20 +134,27 @@ mac_kld_check_load(struct ucred *cred, struct vnode *vp)
 	ASSERT_VOP_LOCKED(vp, "mac_kld_check_load");
 
 	MAC_CHECK(kld_check_load, cred, vp, vp->v_label);
+	MAC_CHECK_PROBE2(kld_check_load, error, cred, vp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE1(kld_check_stat, "struct ucred *");
+
 int
 mac_kld_check_stat(struct ucred *cred)
 {
 	int error;
 
 	MAC_CHECK(kld_check_stat, cred);
+	MAC_CHECK_PROBE1(kld_check_stat, error, cred);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(system_check_acct, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_system_check_acct(struct ucred *cred, struct vnode *vp)
 {
@@ -139,20 +166,27 @@ mac_system_check_acct(struct ucred *cred, struct vnode *vp)
 
 	MAC_CHECK(system_check_acct, cred, vp,
 	    vp != NULL ? vp->v_label : NULL);
+	MAC_CHECK_PROBE2(system_check_acct, error, cred, vp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(system_check_reboot, "struct ucred *", "int");
+
 int
 mac_system_check_reboot(struct ucred *cred, int howto)
 {
 	int error;
 
 	MAC_CHECK(system_check_reboot, cred, howto);
+	MAC_CHECK_PROBE2(system_check_reboot, error, cred, howto);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(system_check_swapon, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_system_check_swapon(struct ucred *cred, struct vnode *vp)
 {
@@ -161,9 +195,14 @@ mac_system_check_swapon(struct ucred *cred, struct vnode *vp)
 	ASSERT_VOP_LOCKED(vp, "mac_system_check_swapon");
 
 	MAC_CHECK(system_check_swapon, cred, vp, vp->v_label);
+	MAC_CHECK_PROBE2(system_check_swapon, error, cred, vp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(system_check_swapoff, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_system_check_swapoff(struct ucred *cred, struct vnode *vp)
 {
@@ -172,9 +211,14 @@ mac_system_check_swapoff(struct ucred *cred, struct vnode *vp)
 	ASSERT_VOP_LOCKED(vp, "mac_system_check_swapoff");
 
 	MAC_CHECK(system_check_swapoff, cred, vp, vp->v_label);
+	MAC_CHECK_PROBE2(system_check_swapoff, error, cred, vp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(system_check_sysctl, "struct ucred *",
+    "struct sysctl_oid *", "struct sysctl_req *");
+
 int
 mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
     void *arg1, int arg2, struct sysctl_req *req)
@@ -186,6 +230,7 @@ mac_system_check_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
 	 * but since it's not exported from kern_sysctl.c, we can't.
 	 */
 	MAC_CHECK(system_check_sysctl, cred, oidp, arg1, arg2, req);
+	MAC_CHECK_PROBE3(system_check_sysctl, error, cred, oidp, req);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_sysv_msg.c b/sys/security/mac/mac_sysv_msg.c
index 2c5bbca..1053871 100644
--- a/sys/security/mac/mac_sysv_msg.c
+++ b/sys/security/mac/mac_sysv_msg.c
@@ -2,6 +2,7 @@
  * Copyright (c) 2003-2004 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
  * Copyright (c) 2008 Apple Inc.
+ * Copyright (c) 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project in part by Network
@@ -12,6 +13,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -37,6 +41,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -45,6 +50,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/sbuf.h>
+#include <sys/sdt.h>
 #include <sys/systm.h>
 #include <sys/vnode.h>
 #include <sys/mount.h>
@@ -163,68 +169,95 @@ mac_sysvmsq_cleanup(struct msqid_kernel *msqkptr)
 	MAC_PERFORM(sysvmsq_cleanup, msqkptr->label);
 }
 
+MAC_CHECK_PROBE_DEFINE3(sysvmsq_check_msgmsq, "struct ucred *",
+    "struct msg *", "struct msqid_kernel *");
+
 int
 mac_sysvmsq_check_msgmsq(struct ucred *cred, struct msg *msgptr,
 	struct msqid_kernel *msqkptr)
 {
 	int error;
 
-	MAC_CHECK(sysvmsq_check_msgmsq, cred,  msgptr, msgptr->label,
+	MAC_CHECK(sysvmsq_check_msgmsq, cred, msgptr, msgptr->label,
 	    msqkptr, msqkptr->label);
+	MAC_CHECK_PROBE3(sysvmsq_check_msgmsq, error, cred, msgptr, msqkptr);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(sysvmsq_check_msgrcv, "struct ucred *",
+    "struct msg *");
+
 int
 mac_sysvmsq_check_msgrcv(struct ucred *cred, struct msg *msgptr)
 {
 	int error;
 
 	MAC_CHECK(sysvmsq_check_msgrcv, cred, msgptr, msgptr->label);
+	MAC_CHECK_PROBE2(sysvmsq_check_msgrcv, error, cred, msgptr);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(sysvmsq_check_msgrmid, "struct ucred *",
+    "struct msg *");
+
 int
 mac_sysvmsq_check_msgrmid(struct ucred *cred, struct msg *msgptr)
 {
 	int error;
 
-	MAC_CHECK(sysvmsq_check_msgrmid, cred,  msgptr, msgptr->label);
+	MAC_CHECK(sysvmsq_check_msgrmid, cred, msgptr, msgptr->label);
+	MAC_CHECK_PROBE2(sysvmsq_check_msgrmid, error, cred, msgptr);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(sysvmsq_check_msqget, "struct ucred *",
+    "struct msqid_kernel *");
+
 int
 mac_sysvmsq_check_msqget(struct ucred *cred, struct msqid_kernel *msqkptr)
 {
 	int error;
 
 	MAC_CHECK(sysvmsq_check_msqget, cred, msqkptr, msqkptr->label);
+	MAC_CHECK_PROBE2(sysvmsq_check_msqget, error, cred, msqkptr);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(sysvmsq_check_msqsnd, "struct ucred *",
+    "struct msqid_kernel *");
+
 int
 mac_sysvmsq_check_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr)
 {
 	int error;
 
 	MAC_CHECK(sysvmsq_check_msqsnd, cred, msqkptr, msqkptr->label);
+	MAC_CHECK_PROBE2(sysvmsq_check_msqsnd, error, cred, msqkptr);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(sysvmsq_check_msqrcv, "struct ucred *",
+    "struct msqid_kernel *");
+
 int
 mac_sysvmsq_check_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr)
 {
 	int error;
 
 	MAC_CHECK(sysvmsq_check_msqrcv, cred, msqkptr, msqkptr->label);
+	MAC_CHECK_PROBE2(sysvmsq_check_msqrcv, error, cred, msqkptr);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(sysvmsq_check_msqctl, "struct ucred *",
+    "struct msqid_kernel *", "int");
+
 int
 mac_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
     int cmd)
@@ -232,6 +265,7 @@ mac_sysvmsq_check_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
 	int error;
 
 	MAC_CHECK(sysvmsq_check_msqctl, cred, msqkptr, msqkptr->label, cmd);
+	MAC_CHECK_PROBE3(sysvmsq_check_msqctl, error, cred, msqkptr, cmd);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_sysv_sem.c b/sys/security/mac/mac_sysv_sem.c
index 94a1107..9fc13fa 100644
--- a/sys/security/mac/mac_sysv_sem.c
+++ b/sys/security/mac/mac_sysv_sem.c
@@ -1,6 +1,7 @@
 /*-
  * Copyright (c) 2003-2004 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
+ * Copyright (c) 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project in part by Network
@@ -11,6 +12,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -36,6 +40,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -49,6 +54,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mount.h>
 #include <sys/file.h>
 #include <sys/namei.h>
+#include <sys/sdt.h>
 #include <sys/sysctl.h>
 #include <sys/sem.h>
 
@@ -108,6 +114,9 @@ mac_sysvsem_cleanup(struct semid_kernel *semakptr)
 	MAC_PERFORM(sysvsem_cleanup, semakptr->label);
 }
 
+MAC_CHECK_PROBE_DEFINE3(sysvsem_check_semctl, "struct ucred *",
+    "struct semid_kernel *", "int");
+
 int
 mac_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr,
     int cmd)
@@ -116,10 +125,14 @@ mac_sysvsem_check_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 
 	MAC_CHECK(sysvsem_check_semctl, cred, semakptr, semakptr->label,
 	    cmd);
+	MAC_CHECK_PROBE3(sysvsem_check_semctl, error, cred, semakptr, cmd);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(sysvsem_check_semget, "struct ucred *",
+    "struct semid_kernel *");
+
 int
 mac_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr)
 {
@@ -130,6 +143,9 @@ mac_sysvsem_check_semget(struct ucred *cred, struct semid_kernel *semakptr)
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(sysvsem_check_semop, "struct ucred *",
+    "struct semid_kernel *", "size_t");
+
 int
 mac_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr,
     size_t accesstype)
@@ -138,6 +154,8 @@ mac_sysvsem_check_semop(struct ucred *cred, struct semid_kernel *semakptr,
 
 	MAC_CHECK(sysvsem_check_semop, cred, semakptr, semakptr->label,
 	    accesstype);
+	MAC_CHECK_PROBE3(sysvsem_check_semop, error, cred, semakptr,
+	    accesstype);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_sysv_shm.c b/sys/security/mac/mac_sysv_shm.c
index 950c23e..d42cb0b 100644
--- a/sys/security/mac/mac_sysv_shm.c
+++ b/sys/security/mac/mac_sysv_shm.c
@@ -1,6 +1,7 @@
 /*-
  * Copyright (c) 2003-2004 Networks Associates Technology, Inc.
  * Copyright (c) 2006 SPARTA, Inc.
+ * Copyright (c) 2009 Robert N. M. Watson
  * All rights reserved.
  *
  * This software was developed for the FreeBSD Project in part by Network
@@ -11,6 +12,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -36,6 +40,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -49,6 +54,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mount.h>
 #include <sys/file.h>
 #include <sys/namei.h>
+#include <sys/sdt.h>
 #include <sys/sysctl.h>
 #include <sys/shm.h>
 
@@ -108,6 +114,9 @@ mac_sysvshm_cleanup(struct shmid_kernel *shmsegptr)
 	MAC_PERFORM(sysvshm_cleanup, shmsegptr->label);
 }
 
+MAC_CHECK_PROBE_DEFINE3(sysvshm_check_shmat, "struct ucred *",
+    "struct shmid_kernel *", "int");
+
 int
 mac_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
     int shmflg)
@@ -116,10 +125,15 @@ mac_sysvshm_check_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 	MAC_CHECK(sysvshm_check_shmat, cred, shmsegptr, shmsegptr->label,
 	    shmflg);
+	MAC_CHECK_PROBE3(sysvshm_check_shmat, error, cred, shmsegptr,
+	    shmflg);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(sysvshm_check_shmctl, "struct ucred *",
+    "struct shmid_kernel *", "int");
+
 int
 mac_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
     int cmd)
@@ -128,20 +142,28 @@ mac_sysvshm_check_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 	MAC_CHECK(sysvshm_check_shmctl, cred, shmsegptr, shmsegptr->label,
 	    cmd);
+	MAC_CHECK_PROBE3(sysvshm_check_shmctl, error, cred, shmsegptr, cmd);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(sysvshm_check_shmdt, "struct ucred *",
+    "struct shmid *");
+
 int
 mac_sysvshm_check_shmdt(struct ucred *cred, struct shmid_kernel *shmsegptr)
 {
 	int error;
 
 	MAC_CHECK(sysvshm_check_shmdt, cred, shmsegptr, shmsegptr->label);
+	MAC_CHECK_PROBE2(sysvshm_check_shmdt, error, cred, shmsegptr);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(sysvshm_check_shmget, "struct ucred *",
+    "struct shmid_kernel *", "int");
+
 int
 mac_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
     int shmflg)
@@ -150,6 +172,8 @@ mac_sysvshm_check_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 	MAC_CHECK(sysvshm_check_shmget, cred, shmsegptr, shmsegptr->label,
 	    shmflg);
+	MAC_CHECK_PROBE3(sysvshm_check_shmget, error, cred, shmsegptr,
+	    shmflg);
 
 	return (error);
 }
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 42da76c..1ebf520 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 1999-2002 Robert N. M. Watson
+ * Copyright (c) 1999-2002, 2009 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2005 McAfee, Inc.
  * Copyright (c) 2005-2006 SPARTA, Inc.
@@ -17,6 +17,9 @@
  * This software was enhanced by SPARTA ISSO under SPAWAR contract
  * N66001-04-C-6019 ("SEFOS").
  *
+ * This software was developed at the University of Cambridge Computer
+ * Laboratory with support from a grant from Google, Inc. 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -42,6 +45,7 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
+#include "opt_kdtrace.h"
 #include "opt_mac.h"
 
 #include <sys/param.h>
@@ -59,6 +63,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mount.h>
 #include <sys/file.h>
 #include <sys/namei.h>
+#include <sys/sdt.h>
 #include <sys/sysctl.h>
 
 #include <vm/vm.h>
@@ -361,6 +366,9 @@ mac_vnode_execve_will_transition(struct ucred *old, struct vnode *vp,
 	return (result);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_access, "struct ucred *",
+    "struct vnode *", "accmode_t");
+
 int
 mac_vnode_check_access(struct ucred *cred, struct vnode *vp, accmode_t accmode)
 {
@@ -369,9 +377,14 @@ mac_vnode_check_access(struct ucred *cred, struct vnode *vp, accmode_t accmode)
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_access");
 
 	MAC_CHECK(vnode_check_access, cred, vp, vp->v_label, accmode);
+	MAC_CHECK_PROBE3(vnode_check_access, error, cred, vp, accmode);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(vnode_check_chdir, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp)
 {
@@ -380,9 +393,14 @@ mac_vnode_check_chdir(struct ucred *cred, struct vnode *dvp)
 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_chdir");
 
 	MAC_CHECK(vnode_check_chdir, cred, dvp, dvp->v_label);
+	MAC_CHECK_PROBE2(vnode_check_chdir, error, cred, dvp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(vnode_check_chroot, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp)
 {
@@ -391,9 +409,14 @@ mac_vnode_check_chroot(struct ucred *cred, struct vnode *dvp)
 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_chroot");
 
 	MAC_CHECK(vnode_check_chroot, cred, dvp, dvp->v_label);
+	MAC_CHECK_PROBE2(vnode_check_chroot, error, cred, dvp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_create, "struct ucred *",
+    "struct vnode *", "struct componentname *", "struct vattr *");
+
 int
 mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
     struct componentname *cnp, struct vattr *vap)
@@ -403,9 +426,14 @@ mac_vnode_check_create(struct ucred *cred, struct vnode *dvp,
 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_create");
 
 	MAC_CHECK(vnode_check_create, cred, dvp, dvp->v_label, cnp, vap);
+	MAC_CHECK_PROBE4(vnode_check_create, error, cred, dvp, cnp, vap);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_deleteacl, "struct ucred *",
+    "struct vnode *", "acl_type_t");
+
 int
 mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
     acl_type_t type)
@@ -415,9 +443,14 @@ mac_vnode_check_deleteacl(struct ucred *cred, struct vnode *vp,
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_deleteacl");
 
 	MAC_CHECK(vnode_check_deleteacl, cred, vp, vp->v_label, type);
+	MAC_CHECK_PROBE3(vnode_check_deleteacl, error, cred, vp, type);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_deleteextattr, "struct ucred *",
+    "struct vnode *", "int", "const char *");
+
 int
 mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
     int attrnamespace, const char *name)
@@ -428,9 +461,15 @@ mac_vnode_check_deleteextattr(struct ucred *cred, struct vnode *vp,
 
 	MAC_CHECK(vnode_check_deleteextattr, cred, vp, vp->v_label,
 	    attrnamespace, name);
+	MAC_CHECK_PROBE4(vnode_check_deleteextattr, error, cred, vp,
+	    attrnamespace, name);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_exec, "struct ucred *", "struct vnode *",
+    "struct image_params *");
+
 int
 mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
     struct image_params *imgp)
@@ -441,10 +480,14 @@ mac_vnode_check_exec(struct ucred *cred, struct vnode *vp,
 
 	MAC_CHECK(vnode_check_exec, cred, vp, vp->v_label, imgp,
 	    imgp->execlabel);
+	MAC_CHECK_PROBE3(vnode_check_exec, error, cred, vp, imgp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_getacl, "struct ucred *",
+    "struct vnode *", "acl_type_t");
+
 int
 mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
 {
@@ -453,9 +496,14 @@ mac_vnode_check_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_getacl");
 
 	MAC_CHECK(vnode_check_getacl, cred, vp, vp->v_label, type);
+	MAC_CHECK_PROBE3(vnode_check_getacl, error, cred, vp, type);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_getextattr, "struct ucred *",
+    "struct vnode *", "int", "const char *");
+
 int
 mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
     int attrnamespace, const char *name, struct uio *uio)
@@ -466,9 +514,15 @@ mac_vnode_check_getextattr(struct ucred *cred, struct vnode *vp,
 
 	MAC_CHECK(vnode_check_getextattr, cred, vp, vp->v_label,
 	    attrnamespace, name, uio);
+	MAC_CHECK_PROBE4(vnode_check_getextattr, error, cred, vp,
+	    attrnamespace, name);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_link, "struct ucred *", "struct vnode *",
+    "struct vnode *", "struct componentname *");
+
 int
 mac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
     struct vnode *vp, struct componentname *cnp)
@@ -480,9 +534,14 @@ mac_vnode_check_link(struct ucred *cred, struct vnode *dvp,
 
 	MAC_CHECK(vnode_check_link, cred, dvp, dvp->v_label, vp,
 	    vp->v_label, cnp);
+	MAC_CHECK_PROBE4(vnode_check_link, error, cred, dvp, vp, cnp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_listextattr, "struct ucred *",
+    "struct vnode *", "int");
+
 int
 mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
     int attrnamespace)
@@ -493,9 +552,15 @@ mac_vnode_check_listextattr(struct ucred *cred, struct vnode *vp,
 
 	MAC_CHECK(vnode_check_listextattr, cred, vp, vp->v_label,
 	    attrnamespace);
+	MAC_CHECK_PROBE3(vnode_check_listextattr, error, cred, vp,
+	    attrnamespace);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_lookup, "struct ucred *",
+    "struct vnode *", "struct componentname *");
+
 int
 mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
     struct componentname *cnp)
@@ -505,9 +570,14 @@ mac_vnode_check_lookup(struct ucred *cred, struct vnode *dvp,
 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_lookup");
 
 	MAC_CHECK(vnode_check_lookup, cred, dvp, dvp->v_label, cnp);
+	MAC_CHECK_PROBE3(vnode_check_lookup, error, cred, dvp, cnp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_mmap, "struct ucred *", "struct vnode *",
+    "int", "int");
+
 int
 mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
     int flags)
@@ -517,6 +587,8 @@ mac_vnode_check_mmap(struct ucred *cred, struct vnode *vp, int prot,
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_mmap");
 
 	MAC_CHECK(vnode_check_mmap, cred, vp, vp->v_label, prot, flags);
+	MAC_CHECK_PROBE4(vnode_check_mmap, error, cred, vp, prot, flags);
+
 	return (error);
 }
 
@@ -534,6 +606,9 @@ mac_vnode_check_mmap_downgrade(struct ucred *cred, struct vnode *vp,
 	*prot = result;
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_mprotect, "struct ucred *",
+    "struct vnode *", "int");
+
 int
 mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp, int prot)
 {
@@ -542,9 +617,14 @@ mac_vnode_check_mprotect(struct ucred *cred, struct vnode *vp, int prot)
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_mprotect");
 
 	MAC_CHECK(vnode_check_mprotect, cred, vp, vp->v_label, prot);
+	MAC_CHECK_PROBE3(vnode_check_mprotect, error, cred, vp, prot);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_open, "struct ucred *", "struct vnode *",
+    "accmode_t");
+
 int
 mac_vnode_check_open(struct ucred *cred, struct vnode *vp, accmode_t accmode)
 {
@@ -556,6 +636,9 @@ mac_vnode_check_open(struct ucred *cred, struct vnode *vp, accmode_t accmode)
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_poll, "struct ucred *", "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp)
@@ -566,10 +649,15 @@ mac_vnode_check_poll(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(vnode_check_poll, active_cred, file_cred, vp,
 	    vp->v_label);
+	MAC_CHECK_PROBE3(vnode_check_poll, error, active_cred, file_cred,
+	    vp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_read, "struct ucred *", "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp)
@@ -580,10 +668,15 @@ mac_vnode_check_read(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(vnode_check_read, active_cred, file_cred, vp,
 	    vp->v_label);
+	MAC_CHECK_PROBE3(vnode_check_read, error, active_cred, file_cred,
+	    vp);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(vnode_check_readdir, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_readdir(struct ucred *cred, struct vnode *dvp)
 {
@@ -592,9 +685,14 @@ mac_vnode_check_readdir(struct ucred *cred, struct vnode *dvp)
 	ASSERT_VOP_LOCKED(dvp, "mac_vnode_check_readdir");
 
 	MAC_CHECK(vnode_check_readdir, cred, dvp, dvp->v_label);
+	MAC_CHECK_PROBE2(vnode_check_readdir, error, cred, dvp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(vnode_check_readlink, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
 {
@@ -603,9 +701,14 @@ mac_vnode_check_readlink(struct ucred *cred, struct vnode *vp)
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_readlink");
 
 	MAC_CHECK(vnode_check_readlink, cred, vp, vp->v_label);
+	MAC_CHECK_PROBE2(vnode_check_readlink, error, cred, vp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_relabel, "struct ucred *",
+    "struct vnode *", "struct label *");
+
 static int
 mac_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
     struct label *newlabel)
@@ -615,10 +718,14 @@ mac_vnode_check_relabel(struct ucred *cred, struct vnode *vp,
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_relabel");
 
 	MAC_CHECK(vnode_check_relabel, cred, vp, vp->v_label, newlabel);
+	MAC_CHECK_PROBE3(vnode_check_relabel, error, cred, vp, newlabel);
 
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_rename_from, "struct ucred *",
+    "struct vnode *", "struct vnode *", "struct componentname *");
+
 int
 mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
     struct vnode *vp, struct componentname *cnp)
@@ -630,9 +737,14 @@ mac_vnode_check_rename_from(struct ucred *cred, struct vnode *dvp,
 
 	MAC_CHECK(vnode_check_rename_from, cred, dvp, dvp->v_label, vp,
 	    vp->v_label, cnp);
+	MAC_CHECK_PROBE4(vnode_check_rename_from, error, cred, dvp, vp, cnp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_rename_to, "struct ucred *",
+    "struct vnode *", "struct vnode *", "struct componentname *");
+
 int
 mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
     struct vnode *vp, int samedir, struct componentname *cnp)
@@ -644,9 +756,13 @@ mac_vnode_check_rename_to(struct ucred *cred, struct vnode *dvp,
 
 	MAC_CHECK(vnode_check_rename_to, cred, dvp, dvp->v_label, vp,
 	    vp != NULL ? vp->v_label : NULL, samedir, cnp);
+	MAC_CHECK_PROBE4(vnode_check_rename_to, error, cred, dvp, vp, cnp);
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE2(vnode_check_revoke, "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp)
 {
@@ -655,9 +771,14 @@ mac_vnode_check_revoke(struct ucred *cred, struct vnode *vp)
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_revoke");
 
 	MAC_CHECK(vnode_check_revoke, cred, vp, vp->v_label);
+	MAC_CHECK_PROBE2(vnode_check_revoke, error, cred, vp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_setacl, "struct ucred *",
+    "struct vnode *", "acl_tpe_t", "struct acl *");
+
 int
 mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
     struct acl *acl)
@@ -667,9 +788,14 @@ mac_vnode_check_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setacl");
 
 	MAC_CHECK(vnode_check_setacl, cred, vp, vp->v_label, type, acl);
+	MAC_CHECK_PROBE4(vnode_check_setacl, error, cred, vp, type, acl);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_setextattr, "struct ucred *",
+    "struct vnode *", "int", "const char *");
+
 int
 mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
     int attrnamespace, const char *name, struct uio *uio)
@@ -680,9 +806,15 @@ mac_vnode_check_setextattr(struct ucred *cred, struct vnode *vp,
 
 	MAC_CHECK(vnode_check_setextattr, cred, vp, vp->v_label,
 	    attrnamespace, name, uio);
+	MAC_CHECK_PROBE4(vnode_check_setextattr, error, cred, vp,
+	    attrnamespace, name);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_setflags, "struct ucred *",
+    "struct vnode *", "u_long");
+
 int
 mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
 {
@@ -691,9 +823,14 @@ mac_vnode_check_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setflags");
 
 	MAC_CHECK(vnode_check_setflags, cred, vp, vp->v_label, flags);
+	MAC_CHECK_PROBE3(vnode_check_setflags, error, cred, vp, flags);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_setmode, "struct ucred *",
+    "struct vnode *", "mode_t");
+
 int
 mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
 {
@@ -702,9 +839,14 @@ mac_vnode_check_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setmode");
 
 	MAC_CHECK(vnode_check_setmode, cred, vp, vp->v_label, mode);
+	MAC_CHECK_PROBE3(vnode_check_setmode, error, cred, vp, mode);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_setowner, "struct ucred *",
+    "struct vnode *", "uid_t", "gid_t");
+
 int
 mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
     gid_t gid)
@@ -714,9 +856,14 @@ mac_vnode_check_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
 	ASSERT_VOP_LOCKED(vp, "mac_vnode_check_setowner");
 
 	MAC_CHECK(vnode_check_setowner, cred, vp, vp->v_label, uid, gid);
+	MAC_CHECK_PROBE4(vnode_check_setowner, error, cred, vp, uid, gid);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_setutimes, "struct ucred *",
+    "struct vnode *", "struct timespec *", "struct timespec *");
+
 int
 mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
     struct timespec atime, struct timespec mtime)
@@ -727,9 +874,15 @@ mac_vnode_check_setutimes(struct ucred *cred, struct vnode *vp,
 
 	MAC_CHECK(vnode_check_setutimes, cred, vp, vp->v_label, atime,
 	    mtime);
+	MAC_CHECK_PROBE4(vnode_check_setutimes, error, cred, vp, &atime,
+	    &mtime);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_stat, "struct ucred *", "struct ucred *",
+    "struct vnode *");
+
 int
 mac_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp)
@@ -740,9 +893,15 @@ mac_vnode_check_stat(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(vnode_check_stat, active_cred, file_cred, vp,
 	    vp->v_label);
+	MAC_CHECK_PROBE3(vnode_check_stat, error, active_cred, file_cred,
+	    vp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE4(vnode_check_unlink, "struct ucred *",
+    "struct vnode *", "struct vnode *", "struct componentname *");
+
 int
 mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
     struct vnode *vp, struct componentname *cnp)
@@ -754,9 +913,14 @@ mac_vnode_check_unlink(struct ucred *cred, struct vnode *dvp,
 
 	MAC_CHECK(vnode_check_unlink, cred, dvp, dvp->v_label, vp,
 	    vp->v_label, cnp);
+	MAC_CHECK_PROBE4(vnode_check_unlink, error, cred, dvp, vp, cnp);
+
 	return (error);
 }
 
+MAC_CHECK_PROBE_DEFINE3(vnode_check_write, "struct ucred *",
+    "struct ucred *", "struct vnode *");
+
 int
 mac_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp)
@@ -767,6 +931,8 @@ mac_vnode_check_write(struct ucred *active_cred, struct ucred *file_cred,
 
 	MAC_CHECK(vnode_check_write, active_cred, file_cred, vp,
 	    vp->v_label);
+	MAC_CHECK_PROBE3(vnode_check_write, error, active_cred, file_cred,
+	    vp);
 
 	return (error);
 }
@@ -786,12 +952,16 @@ mac_mount_create(struct ucred *cred, struct mount *mp)
 	MAC_PERFORM(mount_create, cred, mp, mp->mnt_label);
 }
 
+MAC_CHECK_PROBE_DEFINE2(mount_check_stat, "struct ucred *",
+    "struct mount *");
+
 int
 mac_mount_check_stat(struct ucred *cred, struct mount *mount)
 {
 	int error;
 
 	MAC_CHECK(mount_check_stat, cred, mount, mount->mnt_label);
+	MAC_CHECK_PROBE2(mount_check_stat, error, cred, mount);
 
 	return (error);
 }