xnu-7195.101.1.tar.gz

[apple/xnu.git] / security / mac_base.c

diff --git a/security/mac_base.c b/security/mac_base.c
index 37c9d05af09e5d26b66dd5d3967d30a31e2e3c8a..7ac90d1647903b708f02d407e62f5d72cb24b9c9 100644 (file)
--- a/security/mac_base.c
+++ b/security/mac_base.c
@@ -1,8 +1,8 @@
 /*
 /*

- * Copyright (c) 2007 Apple Inc. All rights reserved.
+ * Copyright (c) 2007-2020 Apple Inc. All rights reserved.

  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

- * 
+ *

  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in


@@ -11,10 +11,10 @@
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.
  * unlawful or unlicensed copies of an Apple operating system, or to
  * circumvent, violate, or enable the circumvention or violation of, any
  * terms of an Apple operating system software license agreement.

- * 
+ *

  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  * Please obtain a copy of the License at
  * http://www.opensource.apple.com/apsl/ and read it before using this file.

- * 
+ *

  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,


@@ -22,7 +22,7 @@
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  * Please see the License for the specific language governing rights and
  * limitations under the License.

- * 
+ *

  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /*-
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 /*-


@@ -79,7 +79,8 @@
 #include <sys/vfs_context.h>
 #include <sys/namei.h>
 #include <bsd/bsm/audit.h>
 #include <sys/vfs_context.h>
 #include <sys/namei.h>
 #include <bsd/bsm/audit.h>

-#include <bsd/bsm/audit_kernel.h>
+#include <bsd/security/audit/audit.h>
+#include <bsd/security/audit/audit_private.h>

 #include <sys/file.h>
 #include <sys/file_internal.h>
 #include <sys/filedesc.h>
 #include <sys/file.h>
 #include <sys/file_internal.h>
 #include <sys/filedesc.h>


@@ -88,14 +89,13 @@
 #include <sys/kauth.h>
 #include <sys/sysproto.h>
 
 #include <sys/kauth.h>
 #include <sys/sysproto.h>
 

+#include <mach/exception_types.h>

 #include <mach/vm_types.h>
 #include <mach/vm_prot.h>
 
 #include <mach/vm_types.h>
 #include <mach/vm_prot.h>
 

-#include <kern/zalloc.h>
+#include <kern/kalloc.h>

 #include <kern/sched_prim.h>
 #include <kern/sched_prim.h>

-#include <osfmk/kern/task.h>
-#include <osfmk/kern/kalloc.h>
-#include <libsa/libsa/kext.h>
+#include <kern/task.h>

 
 #if CONFIG_MACF
 #include <security/mac.h>
 
 #if CONFIG_MACF
 #include <security/mac.h>


@@ -105,26 +105,26 @@
 #include <security/mac_mach_internal.h>
 #endif
 
 #include <security/mac_mach_internal.h>
 #endif
 

-/* 
+#include <libkern/section_keywords.h>
+
+/*

  * define MB_DEBUG to display run-time debugging information
  * #define MB_DEBUG 1
  */
 
 #ifdef MB_DEBUG
  * define MB_DEBUG to display run-time debugging information
  * #define MB_DEBUG 1
  */
 
 #ifdef MB_DEBUG

-#define DPRINTF(x)     printf x
+#define DPRINTF(x)      printf x

 #else
 #define MB_DEBUG
 #define DPRINTF(x)
 #endif
 
 #if CONFIG_MACF
 #else
 #define MB_DEBUG
 #define DPRINTF(x)
 #endif
 
 #if CONFIG_MACF

-SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW|CTLFLAG_LOCKED, 0, 
+SYSCTL_NODE(, OID_AUTO, security, CTLFLAG_RW | CTLFLAG_LOCKED, 0,

     "Security Controls");
     "Security Controls");

-SYSCTL_NODE(_security, OID_AUTO, mac, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
+SYSCTL_EXTENSIBLE_NODE(_security, OID_AUTO, mac, CTLFLAG_RW | CTLFLAG_LOCKED, 0,

     "TrustedBSD MAC policy controls");
 
     "TrustedBSD MAC policy controls");
 

-
-

 /*
  * Declare that the kernel provides MAC support, version 1.  This permits
  * modules to refuse to be loaded if the necessary support isn't present,
 /*
  * Declare that the kernel provides MAC support, version 1.  This permits
  * modules to refuse to be loaded if the necessary support isn't present,


@@ -140,7 +140,7 @@ MODULE_VERSION(kernel_mac_support, 1);
 
 static unsigned int mac_max_slots = MAC_MAX_SLOTS;
 static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;
 
 static unsigned int mac_max_slots = MAC_MAX_SLOTS;
 static unsigned int mac_slot_offsets_free = (1 << MAC_MAX_SLOTS) - 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD,
+SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD | CTLFLAG_LOCKED,

     &mac_max_slots, 0, "");
 
 /*
     &mac_max_slots, 0, "");
 
 /*


@@ -148,112 +148,81 @@ SYSCTL_UINT(_security_mac, OID_AUTO, max_slots, CTLFLAG_RD,
  * access to this variable is serialized during the boot process.  Following
  * the end of serialization, we don't update this flag; no locking.
  */
  * access to this variable is serialized during the boot process.  Following
  * the end of serialization, we don't update this flag; no locking.
  */

-int    mac_late = 0;
+int     mac_late = 0;

 
 /*
  * Flag to indicate whether or not we should allocate label storage for
 
 /*
  * Flag to indicate whether or not we should allocate label storage for

- * new mbufs.  Since most dynamic policies we currently work with don't
- * rely on mbuf labeling, try to avoid paying the cost of mtag allocation
+ * new vnodes.  Since most dynamic policies we currently work with don't
+ * rely on vnode labeling, try to avoid paying the cost of mtag allocation

  * unless specifically notified of interest.  One result of this is
  * unless specifically notified of interest.  One result of this is

- * that if a dynamically loaded policy requests mbuf labels, it must
- * be able to deal with a NULL label being returned on any mbufs that
+ * that if a dynamically loaded policy requests vnode labels, it must
+ * be able to deal with a NULL label being returned on any vnodes that

  * were already in flight when the policy was loaded.  Since the policy
  * already has to deal with uninitialized labels, this probably won't
  * were already in flight when the policy was loaded.  Since the policy
  * already has to deal with uninitialized labels, this probably won't

- * be a problem.  Note: currently no locking.  Will this be a problem?
+ * be a problem.

  */
  */

-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0
-static int     mac_labelmbufs = 0;
+#if CONFIG_MACF_LAZY_VNODE_LABELS
+unsigned int    mac_label_vnodes = 1;
+#else
+unsigned int    mac_label_vnodes = 0;
+#endif /* CONFIG_MACF_LAZY_VNODE_LABELS */
+SYSCTL_UINT(_security_mac, OID_AUTO, labelvnodes, SECURITY_MAC_CTLFLAGS
+#if CONFIG_MACF_LAZY_VNODE_LABELS
+    | CTLFLAG_RD

 #endif
 #endif

+    , &mac_label_vnodes, 0, "Label all vnodes");

 
 

-unsigned int   mac_mmap_revocation = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation, CTLFLAG_RW,
-    &mac_mmap_revocation, 0, "Revoke mmap access to files on subject "
-    "relabel");
-
-unsigned int   mac_mmap_revocation_via_cow = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, mmap_revocation_via_cow, CTLFLAG_RW,
-    &mac_mmap_revocation_via_cow, 0, "Revoke mmap access to files via "
-    "copy-on-write semantics, or by removing all write access");
+unsigned int mac_vnode_label_count = 0;
+SYSCTL_UINT(_security_mac, OID_AUTO, vnode_label_count, SECURITY_MAC_CTLFLAGS | CTLFLAG_RD,
+    &mac_vnode_label_count, 0, "Count of vnode labels");

 
 unsigned int mac_device_enforce = 1;
 
 unsigned int mac_device_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, CTLFLAG_RW,
-          &mac_device_enforce, 0, "Enforce MAC policy on device operations");
-
-unsigned int mac_file_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, file_enforce, CTLFLAG_RW,
-       &mac_file_enforce, 0, "Enforce MAC policy on file operations");
-
-unsigned int mac_iokit_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, iokit_enforce, CTLFLAG_RW,
-       &mac_file_enforce, 0, "Enforce MAC policy on IOKit operations");
+SYSCTL_UINT(_security_mac, OID_AUTO, device_enforce, SECURITY_MAC_CTLFLAGS,
+    &mac_device_enforce, 0, "Enforce MAC policy on device operations");

 
 

-unsigned int   mac_pipe_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, CTLFLAG_RW,
+unsigned int    mac_pipe_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, pipe_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
 
     &mac_pipe_enforce, 0, "Enforce MAC policy on pipe operations");
 

-unsigned int   mac_posixsem_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, CTLFLAG_RW,
+unsigned int    mac_posixsem_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, posixsem_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
 
 unsigned int mac_posixshm_enforce = 1;
     &mac_posixsem_enforce, 0, "Enforce MAC policy on POSIX semaphores");
 
 unsigned int mac_posixshm_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, CTLFLAG_RW,
+SYSCTL_UINT(_security_mac, OID_AUTO, posixshm_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
 
     &mac_posixshm_enforce, 0, "Enforce MAC policy on Posix Shared Memory");
 

-unsigned int   mac_proc_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, CTLFLAG_RW,
-          &mac_proc_enforce, 0, "Enforce MAC policy on process operations");
+unsigned int    mac_proc_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, proc_enforce, SECURITY_MAC_CTLFLAGS,
+    &mac_proc_enforce, 0, "Enforce MAC policy on process operations");

 
 unsigned int mac_socket_enforce = 1;
 
 unsigned int mac_socket_enforce = 1;

-SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, CTLFLAG_RW,
-       &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");
+SYSCTL_UINT(_security_mac, OID_AUTO, socket_enforce, SECURITY_MAC_CTLFLAGS,
+    &mac_socket_enforce, 0, "Enforce MAC policy on socket operations");

 
 

-unsigned int   mac_system_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, CTLFLAG_RW,
+unsigned int    mac_system_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, system_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
 
     &mac_system_enforce, 0, "Enforce MAC policy on system-wide interfaces");
 

-unsigned int   mac_sysvmsg_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, CTLFLAG_RW,
+unsigned int    mac_sysvmsg_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvmsg_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
 
     &mac_sysvmsg_enforce, 0, "Enforce MAC policy on System V IPC message queues");
 

-unsigned int   mac_sysvsem_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, CTLFLAG_RW,
+unsigned int    mac_sysvsem_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, sysvsem_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
 
     &mac_sysvsem_enforce, 0, "Enforce MAC policy on System V IPC semaphores");
 

-unsigned int   mac_sysvshm_enforce = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, CTLFLAG_RW,
+unsigned int    mac_sysvshm_enforce = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, sysvshm_enforce, SECURITY_MAC_CTLFLAGS,

     &mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
 
     &mac_sysvshm_enforce, 0, "Enforce MAC policy on System V Shared Memory");
 

-unsigned int   mac_vm_enforce = 1;
-SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, CTLFLAG_RW,
-          &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");
-
-unsigned int   mac_vnode_enforce = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, CTLFLAG_RW,
-          &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");
-
-
-#if CONFIG_MACF_MACH
-unsigned int   mac_port_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, port_enforce, CTLFLAG_RW,
-    &mac_port_enforce, 0, "Enforce MAC policy on Mach port operations");
-
-unsigned int   mac_task_enforce = 0;
-SYSCTL_UINT(_security_mac, OID_AUTO, task_enforce, CTLFLAG_RW,
-    &mac_task_enforce, 0, "Enforce MAC policy on Mach task operations");
-#endif
-
-#if CONFIG_MACF_NET
-unsigned int mac_label_mbufs   = 1;
-SYSCTL_UINT(_security_mac, OID_AUTO, label_mbufs, CTLFLAG_RW,
-       &mac_label_mbufs, 0, "Label all MBUFs");
-#endif
+unsigned int    mac_vm_enforce = 1;
+SYSCTL_INT(_security_mac, OID_AUTO, vm_enforce, SECURITY_MAC_CTLFLAGS,
+    &mac_vm_enforce, 0, "Enforce MAC policy on VM operations");

 
 

-/*
- * mac_audit_data_zone is the zone used for data pushed into the audit
- * record by policies. Using a zone simplifies memory management of this
- * data, and allows tracking of the amount of data in flight.
- */
-extern zone_t mac_audit_data_zone;
+unsigned int    mac_vnode_enforce = 1;
+SYSCTL_UINT(_security_mac, OID_AUTO, vnode_enforce, SECURITY_MAC_CTLFLAGS,
+    &mac_vnode_enforce, 0, "Enforce MAC policy on vnode operations");

 
 /*
  * mac_policy_list holds the list of policy modules.  Modules with a
 
 /*
  * mac_policy_list holds the list of policy modules.  Modules with a


@@ -271,177 +240,59 @@ extern zone_t mac_audit_data_zone;
  * For a few special operations involving a change to the list of
  * active policies, the mtx itself must be held.
  */
  * For a few special operations involving a change to the list of
  * active policies, the mtx itself must be held.
  */

-static lck_mtx_t *mac_policy_mtx;
+static LCK_GRP_DECLARE(mac_lck_grp, "MAC lock");
+static LCK_MTX_DECLARE(mac_policy_mtx, &mac_lck_grp);

 
 /*
 
 /*

- * Policy list array allocation chunk size. Trying to set this so that we
- * allocate a page at a time.
+ * Policy list array allocation chunk size. Each entry holds a pointer.

  */
  */

-#define MAC_POLICY_LIST_CHUNKSIZE 512
+#define MAC_POLICY_LIST_CHUNKSIZE 8

 
 static int mac_policy_busy;
 
 
 static int mac_policy_busy;
 

+#if !XNU_TARGET_OS_OSX
+SECURITY_READ_ONLY_LATE(mac_policy_list_t) mac_policy_list;
+SECURITY_READ_ONLY_LATE(static struct mac_policy_list_element) mac_policy_static_entries[MAC_POLICY_LIST_CHUNKSIZE];
+#else

 mac_policy_list_t mac_policy_list;
 mac_policy_list_t mac_policy_list;

+#endif

 
 /*
  * mac_label_element_list holds the master list of label namespaces for
  * all the policies. When a policy is loaded, each of it's label namespace
  * elements is added to the master list if not already present. When a
 
 /*
  * mac_label_element_list holds the master list of label namespaces for
  * all the policies. When a policy is loaded, each of it's label namespace
  * elements is added to the master list if not already present. When a

- * policy is unloaded, the namespace elements are removed if no other 
+ * policy is unloaded, the namespace elements are removed if no other

  * policy is interested in that namespace element.
  */
 struct mac_label_element_list_t mac_label_element_list;
 struct mac_label_element_list_t mac_static_label_element_list;
 
  * policy is interested in that namespace element.
  */
 struct mac_label_element_list_t mac_label_element_list;
 struct mac_label_element_list_t mac_static_label_element_list;
 

-/*
- * Journal of label operations that occur before policies are loaded.
- */
-struct mac_label_journal_list_t mac_label_journal_list;
-
-int
-mac_label_journal_add (struct label *l, int type)
-{
-       struct mac_label_journal *mlj;
-
-       if (mac_label_journal_find(l))
-               return (0);
-
-       MALLOC(mlj, struct mac_label_journal *,
-               sizeof(struct mac_label_journal), M_MACTEMP, M_WAITOK);
-       mlj->l = l;
-       mlj->type = type;
-       TAILQ_INSERT_TAIL(&mac_label_journal_list, mlj, link);
-
-       return (0);
-}
-
-int
-mac_label_journal_remove (struct label *l)
-{
-       struct mac_label_journal *mlj;
-
-       mlj = mac_label_journal_find(l);
-       if (mlj == NULL)
-               return (-1);
-
-       TAILQ_REMOVE(&mac_label_journal_list, mlj, link);
-       FREE(mlj, M_MACTEMP);
-       return (0);
-}
-
-struct mac_label_journal *
-mac_label_journal_find (struct label *l)
-{
-       struct mac_label_journal *mlj;
-
-       TAILQ_FOREACH(mlj, &mac_label_journal_list, link) {
-               if (l == mlj->l)
-                       return (mlj);
-       }
-
-       return (NULL);
-}
-
-int
-mac_label_journal (struct label *l, int op, ...)
-{
-       struct mac_label_journal *mlj;
-       va_list ap;
-
-       mlj = mac_label_journal_find(l);
-       if (mlj == NULL) {
-               printf("%s(): Label not in list!\n", __func__);
-               return (-1);
-       }
-
-       if (op == MLJ_PORT_OP_UPDATE) {
-               va_start(ap, op);
-               mlj->kotype = va_arg(ap, int);
-               va_end(ap);
-       }
-
-       mlj->ops |= op;
-       return (0);
-}
-
-/*
- * The assumption during replay is that the system is totally
- * serialized and no additional tasks/ports will be created.
- */
-void
-mac_label_journal_replay (void)
-{
-       struct mac_label_journal *mlj;
-
-       TAILQ_FOREACH(mlj, &mac_label_journal_list, link) {
-               switch (mlj->type) {
-               case MLJ_TYPE_PORT:
-                       if (mlj->ops & MLJ_PORT_OP_INIT)
-                               MAC_PERFORM(port_label_init, mlj->l);
-                       if (mlj->ops & MLJ_PORT_OP_CREATE_K)
-                               MAC_PERFORM(port_label_associate_kernel, mlj->l, 0);
-                       if (mlj->ops & MLJ_PORT_OP_UPDATE)
-                               MAC_PERFORM(port_label_update_kobject, mlj->l,
-                                               mlj->kotype);
-                       break;
-               case MLJ_TYPE_TASK:
-                       if (mlj->ops & MLJ_TASK_OP_INIT)
-                               MAC_PERFORM(task_label_init, mlj->l);
-#if 0
-                       /* Not enough context to replay. */
-                       if (mlj->ops & MLJ_TASK_OP_CREATE_K)
-                               ;
-#endif
-                       break;
-               default:
-                       break;
-               }
-       }
-
-       /* Free list */
-       while (!TAILQ_EMPTY(&mac_label_journal_list)) {
-               mlj = TAILQ_FIRST(&mac_label_journal_list);
-               TAILQ_REMOVE(&mac_label_journal_list, mlj, link);
-               FREE(mlj, M_MACTEMP);
-       }
-       return;
-}
-

 static __inline void
 mac_policy_grab_exclusive(void)
 {
 static __inline void
 mac_policy_grab_exclusive(void)
 {

-       lck_mtx_lock(mac_policy_mtx);
+       lck_mtx_lock(&mac_policy_mtx);

        while (mac_policy_busy != 0) {
        while (mac_policy_busy != 0) {

-               lck_mtx_sleep(mac_policy_mtx, LCK_SLEEP_UNLOCK,
-                             (event_t)&mac_policy_busy, THREAD_UNINT);
-               lck_mtx_lock(mac_policy_mtx);
+               lck_mtx_sleep(&mac_policy_mtx, LCK_SLEEP_UNLOCK,
+                   (event_t)&mac_policy_busy, THREAD_UNINT);
+               lck_mtx_lock(&mac_policy_mtx);

        }
 }
 
        }
 }
 

-static __inline void
-mac_policy_assert_exclusive(void)
-{
-       lck_mtx_assert(mac_policy_mtx, LCK_MTX_ASSERT_OWNED);
-       KASSERT(mac_policy_busy == 0,
-           ("mac_policy_assert_exclusive(): not exclusive"));
-}
-

 static __inline void
 mac_policy_release_exclusive(void)
 {
 static __inline void
 mac_policy_release_exclusive(void)
 {

-

        KASSERT(mac_policy_busy == 0,
            ("mac_policy_release_exclusive(): not exclusive"));
        KASSERT(mac_policy_busy == 0,
            ("mac_policy_release_exclusive(): not exclusive"));

-       lck_mtx_unlock(mac_policy_mtx);
+       lck_mtx_unlock(&mac_policy_mtx);

        thread_wakeup((event_t) &mac_policy_busy);
 }
 
 void
 mac_policy_list_busy(void)
 {
        thread_wakeup((event_t) &mac_policy_busy);
 }
 
 void
 mac_policy_list_busy(void)
 {

-        lck_mtx_lock(mac_policy_mtx);
+       lck_mtx_lock(&mac_policy_mtx);

        mac_policy_busy++;
        mac_policy_busy++;

-       lck_mtx_unlock(mac_policy_mtx);
+       lck_mtx_unlock(&mac_policy_mtx);

 }
 
 int
 }
 
 int


@@ -449,28 +300,31 @@ mac_policy_list_conditional_busy(void)
 {
        int ret;
 
 {
        int ret;
 

-       if (mac_policy_list.numloaded <= mac_policy_list.staticmax)
-               return(0);
+       if (mac_policy_list.numloaded <= mac_policy_list.staticmax) {
+               return 0;
+       }

 
 

-       lck_mtx_lock(mac_policy_mtx);
+       lck_mtx_lock(&mac_policy_mtx);

        if (mac_policy_list.numloaded > mac_policy_list.staticmax) {
                mac_policy_busy++;
                ret = 1;
        if (mac_policy_list.numloaded > mac_policy_list.staticmax) {
                mac_policy_busy++;
                ret = 1;

-       } else
+       } else {

                ret = 0;
                ret = 0;

-       lck_mtx_unlock(mac_policy_mtx);
-       return (ret);
+       }
+       lck_mtx_unlock(&mac_policy_mtx);
+       return ret;

 }
 
 void
 mac_policy_list_unbusy(void)
 {
 }
 
 void
 mac_policy_list_unbusy(void)
 {

-       lck_mtx_lock(mac_policy_mtx);
+       lck_mtx_lock(&mac_policy_mtx);

        mac_policy_busy--;
        KASSERT(mac_policy_busy >= 0, ("MAC_POLICY_LIST_LOCK"));
        mac_policy_busy--;
        KASSERT(mac_policy_busy >= 0, ("MAC_POLICY_LIST_LOCK"));

-       if (mac_policy_busy == 0)
+       if (mac_policy_busy == 0) {

                thread_wakeup(&mac_policy_busy);
                thread_wakeup(&mac_policy_busy);

-       lck_mtx_unlock(mac_policy_mtx);
+       }
+       lck_mtx_unlock(&mac_policy_mtx);

 }
 
 /*
 }
 
 /*


@@ -479,10 +333,6 @@ mac_policy_list_unbusy(void)
 void
 mac_policy_init(void)
 {
 void
 mac_policy_init(void)
 {

-       lck_grp_attr_t *mac_lck_grp_attr;
-       lck_attr_t *mac_lck_attr;
-       lck_grp_t *mac_lck_grp;
-

        mac_policy_list.numloaded = 0;
        mac_policy_list.max = MAC_POLICY_LIST_CHUNKSIZE;
        mac_policy_list.maxindex = 0;
        mac_policy_list.numloaded = 0;
        mac_policy_list.max = MAC_POLICY_LIST_CHUNKSIZE;
        mac_policy_list.maxindex = 0;


@@ -490,33 +340,31 @@ mac_policy_init(void)
        mac_policy_list.freehint = 0;
        mac_policy_list.chunks = 1;
 
        mac_policy_list.freehint = 0;
        mac_policy_list.chunks = 1;
 

-       mac_policy_list.entries = kalloc(sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE);
-       bzero(mac_policy_list.entries, sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE); 
+#if !XNU_TARGET_OS_OSX
+       mac_policy_list.entries = mac_policy_static_entries;
+#else
+       mac_policy_list.entries = kalloc_flags(
+               sizeof(struct mac_policy_list_element) * MAC_POLICY_LIST_CHUNKSIZE,
+               Z_WAITOK | Z_ZERO);
+#endif

 
        LIST_INIT(&mac_label_element_list);
        LIST_INIT(&mac_static_label_element_list);
 
        LIST_INIT(&mac_label_element_list);
        LIST_INIT(&mac_static_label_element_list);

-       TAILQ_INIT(&mac_label_journal_list);
-
-       mac_lck_grp_attr = lck_grp_attr_alloc_init();
-       lck_grp_attr_setstat(mac_lck_grp_attr);
-       mac_lck_grp = lck_grp_alloc_init("MAC lock", mac_lck_grp_attr);
-       mac_lck_attr = lck_attr_alloc_init();
-       lck_attr_setdefault(mac_lck_attr);
-       mac_policy_mtx = lck_mtx_alloc_init(mac_lck_grp, mac_lck_attr);
-       lck_attr_free(mac_lck_attr);
-       lck_grp_attr_free(mac_lck_grp_attr);
-       lck_grp_free(mac_lck_grp);
-       
-       mac_labelzone_init();

 }
 
 }
 

+/* Function pointer set up for loading security extensions.
+ * It is set to an actual function after OSlibkernInit()
+ * has been called, and is set back to 0 by OSKextRemoveKextBootstrap()
+ * after bsd_init().
+ */
+void (*load_security_extensions_function)(void) = 0;
+

 /*
  * Init after early Mach startup, but before BSD
  */
 void
 mac_policy_initmach(void)
 {
 /*
  * Init after early Mach startup, but before BSD
  */
 void
 mac_policy_initmach(void)
 {

-

        /*
         * For the purposes of modules that want to know if they were
         * loaded "early", set the mac_late flag once we've processed
        /*
         * For the purposes of modules that want to know if they were
         * loaded "early", set the mac_late flag once we've processed


@@ -524,11 +372,10 @@ mac_policy_initmach(void)
         * kernel startup.
         */
 
         * kernel startup.
         */
 

-       load_security_extensions();
+       if (load_security_extensions_function) {
+               load_security_extensions_function();
+       }

        mac_late = 1;
        mac_late = 1;

-#if CONFIG_MACF_MACH
-       mac_label_journal_replay();
-#endif

 }
 
 /*
 }
 
 /*


@@ -540,10 +387,6 @@ mac_policy_initbsd(void)
        struct mac_policy_conf *mpc;
        u_int i;
 
        struct mac_policy_conf *mpc;
        u_int i;
 

-       mac_audit_data_zone = zinit(MAC_AUDIT_DATA_LIMIT,
-                                   AQ_HIWATER * MAC_AUDIT_DATA_LIMIT,
-                                   8192, "mac_audit_data_zone");
-

        printf("MAC Framework successfully initialized\n");
 
        /* Call bsd init functions of already loaded policies */
        printf("MAC Framework successfully initialized\n");
 
        /* Call bsd init functions of already loaded policies */


@@ -557,8 +400,9 @@ mac_policy_initbsd(void)
 
        for (i = 0; i <= mac_policy_list.maxindex; i++) {
                mpc = mac_get_mpc(i);
 
        for (i = 0; i <= mac_policy_list.maxindex; i++) {
                mpc = mac_get_mpc(i);

-               if ((mpc != NULL) && (mpc->mpc_ops->mpo_policy_initbsd != NULL))
+               if ((mpc != NULL) && (mpc->mpc_ops->mpo_policy_initbsd != NULL)) {

                        (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
                        (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);

+               }

        }
 
        mac_policy_release_exclusive();
        }
 
        mac_policy_release_exclusive();


@@ -566,8 +410,8 @@ mac_policy_initbsd(void)
 
 /*
  * After a policy has been loaded, add the label namespaces managed by the
 
 /*
  * After a policy has been loaded, add the label namespaces managed by the

- * policy to either the static or non-static label namespace list.  
- * A namespace is added to the the list only if it is not already on one of 
+ * policy to either the static or non-static label namespace list.
+ * A namespace is added to the the list only if it is not already on one of

  * the lists.
  */
 void
  * the lists.
  */
 void


@@ -582,66 +426,76 @@ mac_policy_addto_labellist(mac_policy_handle_t handle, int static_entry)
 
        mpc = mac_get_mpc(handle);
 
 
        mpc = mac_get_mpc(handle);
 

-       if (mpc->mpc_labelnames == NULL)
+       if (mpc->mpc_labelnames == NULL) {

                return;
                return;

+       }

 
 

-       if (mpc->mpc_labelname_count == 0)
+       if (mpc->mpc_labelname_count == 0) {

                return;
                return;

+       }

 
 

-       if (static_entry)
+       if (static_entry) {

                list = &mac_static_label_element_list;
                list = &mac_static_label_element_list;

-       else
+       } else {

                list = &mac_label_element_list;
                list = &mac_label_element_list;

+       }

 
        /*
         * Before we grab the policy list lock, allocate enough memory
 
        /*
         * Before we grab the policy list lock, allocate enough memory

-        * to contain the potential new elements so we don't have to 
+        * to contain the potential new elements so we don't have to

         * give up the lock, or allocate with the lock held.
         */
        MALLOC(new_mles, struct mac_label_element **,
            sizeof(struct mac_label_element *) *
            mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK | M_ZERO);
         * give up the lock, or allocate with the lock held.
         */
        MALLOC(new_mles, struct mac_label_element **,
            sizeof(struct mac_label_element *) *
            mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK | M_ZERO);

-       for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
-               MALLOC(new_mles[idx], struct mac_label_element *, 
+       for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {
+               MALLOC(new_mles[idx], struct mac_label_element *,

                    sizeof(struct mac_label_element),
                    M_MACTEMP, M_WAITOK);
                    sizeof(struct mac_label_element),
                    M_MACTEMP, M_WAITOK);

+       }

        mle_free = 0;
        MALLOC(new_mlls, struct mac_label_listener **,
            sizeof(struct mac_label_listener *) *
            mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK);
        mle_free = 0;
        MALLOC(new_mlls, struct mac_label_listener **,
            sizeof(struct mac_label_listener *) *
            mpc->mpc_labelname_count, M_MACTEMP, M_WAITOK);

-       for (idx = 0; idx < mpc->mpc_labelname_count; idx++)
+       for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {

                MALLOC(new_mlls[idx], struct mac_label_listener *,
                    sizeof(struct mac_label_listener), M_MACTEMP, M_WAITOK);
                MALLOC(new_mlls[idx], struct mac_label_listener *,
                    sizeof(struct mac_label_listener), M_MACTEMP, M_WAITOK);

+       }

        mll_free = 0;
 
        mll_free = 0;
 

-       if (mac_late)
+       if (mac_late) {

                mac_policy_grab_exclusive();
                mac_policy_grab_exclusive();

+       }

        for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {
        for (idx = 0; idx < mpc->mpc_labelname_count; idx++) {

-
-               if (*(name = mpc->mpc_labelnames[idx]) == '?')
+               if (*(name = mpc->mpc_labelnames[idx]) == '?') {

                        name++;
                        name++;

+               }

                /*
                /*

-                * Check both label element lists and add to the 
+                * Check both label element lists and add to the

                 * appropriate list only if not already on a list.
                 */
                LIST_FOREACH(mle, &mac_static_label_element_list, mle_list) {
                 * appropriate list only if not already on a list.
                 */
                LIST_FOREACH(mle, &mac_static_label_element_list, mle_list) {

-                       if (*(name2 = mle->mle_name) == '?')
+                       if (*(name2 = mle->mle_name) == '?') {

                                name2++;
                                name2++;

-                       if (strcmp(name, name2) == 0)
+                       }
+                       if (strcmp(name, name2) == 0) {

                                break;
                                break;

+                       }

                }
                if (mle == NULL) {
                        LIST_FOREACH(mle, &mac_label_element_list, mle_list) {
                }
                if (mle == NULL) {
                        LIST_FOREACH(mle, &mac_label_element_list, mle_list) {

-                               if (*(name2 = mle->mle_name) == '?')
+                               if (*(name2 = mle->mle_name) == '?') {

                                        name2++;
                                        name2++;

-                               if (strcmp(name, name2) == 0)
+                               }
+                               if (strcmp(name, name2) == 0) {

                                        break;
                                        break;

+                               }

                        }
                }
                if (mle == NULL) {
                        mle = new_mles[mle_free];
                        strlcpy(mle->mle_name, mpc->mpc_labelnames[idx],
                        }
                }
                if (mle == NULL) {
                        mle = new_mles[mle_free];
                        strlcpy(mle->mle_name, mpc->mpc_labelnames[idx],

-                                       MAC_MAX_LABEL_ELEMENT_NAME);
+                           MAC_MAX_LABEL_ELEMENT_NAME);

                        LIST_INIT(&mle->mle_listeners);
                        LIST_INSERT_HEAD(list, mle, mle_list);
                        mle_free++;
                        LIST_INIT(&mle->mle_listeners);
                        LIST_INSERT_HEAD(list, mle, mle_list);
                        mle_free++;


@@ -652,15 +506,18 @@ mac_policy_addto_labellist(mac_policy_handle_t handle, int static_entry)
                    mll_list);
                mll_free++;
        }
                    mll_list);
                mll_free++;
        }

-       if (mac_late)
+       if (mac_late) {

                mac_policy_release_exclusive();
                mac_policy_release_exclusive();

+       }

 
        /* Free up any unused label elements and listeners */
 
        /* Free up any unused label elements and listeners */

-       for (idx = mle_free; idx < mpc->mpc_labelname_count; idx++)
+       for (idx = mle_free; idx < mpc->mpc_labelname_count; idx++) {

                FREE(new_mles[idx], M_MACTEMP);
                FREE(new_mles[idx], M_MACTEMP);

+       }

        FREE(new_mles, M_MACTEMP);
        FREE(new_mles, M_MACTEMP);

-       for (idx = mll_free; idx < mpc->mpc_labelname_count; idx++)
+       for (idx = mll_free; idx < mpc->mpc_labelname_count; idx++) {

                FREE(new_mlls[idx], M_MACTEMP);
                FREE(new_mlls[idx], M_MACTEMP);

+       }

        FREE(new_mlls, M_MACTEMP);
 }
 
        FREE(new_mlls, M_MACTEMP);
 }
 


@@ -681,11 +538,13 @@ mac_policy_removefrom_labellist(mac_policy_handle_t handle)
 
        mpc = mac_get_mpc(handle);
 
 
        mpc = mac_get_mpc(handle);
 

-       if (mpc->mpc_labelnames == NULL)
+       if (mpc->mpc_labelnames == NULL) {

                return;
                return;

+       }

 
 

-       if (mpc->mpc_labelname_count == 0)
+       if (mpc->mpc_labelname_count == 0) {

                return;
                return;

+       }

 
        /*
         * Unregister policy as being interested in any label
 
        /*
         * Unregister policy as being interested in any label


@@ -715,26 +574,6 @@ mac_policy_removefrom_labellist(mac_policy_handle_t handle)
 static void
 mac_policy_updateflags(void)
 {
 static void
 mac_policy_updateflags(void)
 {

-#if !defined(CONFIG_MACF_ALWAYS_LABEL_MBUF) && 0 /* port to new list style */
-
-       struct mac_policy_conf *tmpc;
-       int labelmbufs;
-
-       mac_policy_assert_exclusive();
-
-       labelmbufs = 0;
-
-       /* XXX - convert to new list structure */
-       LIST_FOREACH(tmpc, &mac_static_policy_list, mpc_list) {
-               if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
-                       labelmbufs++;
-       }
-       LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
-               if (tmpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_LABELMBUFS)
-                       labelmbufs++;
-       }
-       mac_labelmbufs = (labelmbufs != 0);
-#endif

 }
 
 static __inline void
 }
 
 static __inline void


@@ -765,9 +604,10 @@ mac_policy_fixup_mmd_list(struct mac_module_data *new)
                                if (arr->type == MAC_DATA_TYPE_DICT) {
                                        dict = (struct mac_module_data_list *)aele->value;
                                        DPRINTF(("fixup_mmd: dict @%p\n", dict));
                                if (arr->type == MAC_DATA_TYPE_DICT) {
                                        dict = (struct mac_module_data_list *)aele->value;
                                        DPRINTF(("fixup_mmd: dict @%p\n", dict));

-                                       for (k = 0; k < dict->count; k++)
+                                       for (k = 0; k < dict->count; k++) {

                                                mmd_fixup_ele(old, new,
                                                    &(dict->list[k]));
                                                mmd_fixup_ele(old, new,
                                                    &(dict->list[k]));

+                                       }

                                }
                        }
                }
                                }
                        }
                }


@@ -779,7 +619,9 @@ int
 mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
     void *xd)
 {
 mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
     void *xd)
 {

+#if XNU_TARGET_OS_OSX

        struct mac_policy_list_element *tmac_policy_list_element;
        struct mac_policy_list_element *tmac_policy_list_element;

+#endif

        int error, slot, static_entry = 0;
        u_int i;
 
        int error, slot, static_entry = 0;
        u_int i;
 


@@ -787,17 +629,21 @@ mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
         * Some preliminary checks to make sure the policy's conf structure
         * contains the required fields.
         */
         * Some preliminary checks to make sure the policy's conf structure
         * contains the required fields.
         */

-       if (mpc->mpc_name == NULL)
+       if (mpc->mpc_name == NULL) {

                panic("policy's name is not set\n");
                panic("policy's name is not set\n");

+       }

 
 

-       if (mpc->mpc_fullname == NULL)
+       if (mpc->mpc_fullname == NULL) {

                panic("policy's full name is not set\n");
                panic("policy's full name is not set\n");

+       }

 
 

-       if (mpc->mpc_labelname_count > MAC_MAX_MANAGED_NAMESPACES)
+       if (mpc->mpc_labelname_count > MAC_MAX_MANAGED_NAMESPACES) {

                panic("policy's managed label namespaces exceeds maximum\n");
                panic("policy's managed label namespaces exceeds maximum\n");

+       }

 
 

-       if (mpc->mpc_ops == NULL)
+       if (mpc->mpc_ops == NULL) {

                panic("policy's OPs field is NULL\n");
                panic("policy's OPs field is NULL\n");

+       }

 
        error = 0;
 
 
        error = 0;
 


@@ -805,12 +651,13 @@ mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
                if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE) {
                        printf("Module %s does not support late loading.\n",
                            mpc->mpc_name);
                if (mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_NOTLATE) {
                        printf("Module %s does not support late loading.\n",
                            mpc->mpc_name);

-                       return (EPERM);
+                       return EPERM;

                }
                mac_policy_grab_exclusive();
        }
 
        if (mac_policy_list.numloaded >= mac_policy_list.max) {
                }
                mac_policy_grab_exclusive();
        }
 
        if (mac_policy_list.numloaded >= mac_policy_list.max) {

+#if XNU_TARGET_OS_OSX

                /* allocate new policy list array, zero new chunk */
                tmac_policy_list_element =
                    kalloc((sizeof(struct mac_policy_list_element) *
                /* allocate new policy list array, zero new chunk */
                tmac_policy_list_element =
                    kalloc((sizeof(struct mac_policy_list_element) *


@@ -818,28 +665,33 @@ mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
                bzero(&tmac_policy_list_element[mac_policy_list.max],
                    sizeof(struct mac_policy_list_element) *
                    MAC_POLICY_LIST_CHUNKSIZE);
                bzero(&tmac_policy_list_element[mac_policy_list.max],
                    sizeof(struct mac_policy_list_element) *
                    MAC_POLICY_LIST_CHUNKSIZE);

-               
+

                /* copy old entries into new list */
                /* copy old entries into new list */

-               memcpy(tmac_policy_list_element, mac_policy_list.entries, 
-                  sizeof(struct mac_policy_list_element) *
-                  MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
-       
+               memcpy(tmac_policy_list_element, mac_policy_list.entries,
+                   sizeof(struct mac_policy_list_element) *
+                   MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
+

                /* free old array */
                kfree(mac_policy_list.entries,
                    sizeof(struct mac_policy_list_element) *
                    MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);
                /* free old array */
                kfree(mac_policy_list.entries,
                    sizeof(struct mac_policy_list_element) *
                    MAC_POLICY_LIST_CHUNKSIZE * mac_policy_list.chunks);

-               
+

                mac_policy_list.entries = tmac_policy_list_element;
 
                /* Update maximums, etc */
                mac_policy_list.max += MAC_POLICY_LIST_CHUNKSIZE;
                mac_policy_list.chunks++;
                mac_policy_list.entries = tmac_policy_list_element;
 
                /* Update maximums, etc */
                mac_policy_list.max += MAC_POLICY_LIST_CHUNKSIZE;
                mac_policy_list.chunks++;

+#else
+               printf("out of space in mac_policy_list.\n");
+               return ENOMEM;
+#endif /* XNU_TARGET_OS_OSX */

        }
 
        /* Check for policy with same name already loaded */
        for (i = 0; i <= mac_policy_list.maxindex; i++) {
        }
 
        /* Check for policy with same name already loaded */
        for (i = 0; i <= mac_policy_list.maxindex; i++) {

-               if (mac_policy_list.entries[i].mpc == NULL) 
-                       continue;       
+               if (mac_policy_list.entries[i].mpc == NULL) {
+                       continue;
+               }

 
                if (strcmp(mac_policy_list.entries[i].mpc->mpc_name,
                    mpc->mpc_name) == 0) {
 
                if (strcmp(mac_policy_list.entries[i].mpc->mpc_name,
                    mpc->mpc_name) == 0) {


@@ -899,37 +751,41 @@ mac_policy_register(struct mac_policy_conf *mpc, mac_policy_handle_t *handlep,
        mac_policy_list.entries[*handlep].mpc = mpc;
 
        /* Update counters, etc */
        mac_policy_list.entries[*handlep].mpc = mpc;
 
        /* Update counters, etc */

-       if (*handlep > mac_policy_list.maxindex) 
+       if (*handlep > mac_policy_list.maxindex) {

                mac_policy_list.maxindex = *handlep;
                mac_policy_list.maxindex = *handlep;

+       }

        mac_policy_list.numloaded++;
        mac_policy_list.numloaded++;

-       
+

        /* Per-policy initialization. */
        /* Per-policy initialization. */

-       printf ("calling mpo_policy_init for %s\n", mpc->mpc_name);
-       if (mpc->mpc_ops->mpo_policy_init != NULL)
+       printf("calling mpo_policy_init for %s\n", mpc->mpc_name);
+       if (mpc->mpc_ops->mpo_policy_init != NULL) {

                (*(mpc->mpc_ops->mpo_policy_init))(mpc);
                (*(mpc->mpc_ops->mpo_policy_init))(mpc);

+       }

 
        if (mac_late && mpc->mpc_ops->mpo_policy_initbsd != NULL) {
 
        if (mac_late && mpc->mpc_ops->mpo_policy_initbsd != NULL) {

-               printf ("calling mpo_policy_initbsd for %s\n", mpc->mpc_name);
+               printf("calling mpo_policy_initbsd for %s\n", mpc->mpc_name);

                (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
        }
 
        mac_policy_updateflags();
 
                (*(mpc->mpc_ops->mpo_policy_initbsd))(mpc);
        }
 
        mac_policy_updateflags();
 

-       if (mac_late)
+       if (mac_late) {

                mac_policy_release_exclusive();
                mac_policy_release_exclusive();

+       }

 
        mac_policy_addto_labellist(*handlep, static_entry);
 
        printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
            mpc->mpc_name);
 
 
        mac_policy_addto_labellist(*handlep, static_entry);
 
        printf("Security policy loaded: %s (%s)\n", mpc->mpc_fullname,
            mpc->mpc_name);
 

-       return (0);
+       return 0;

 
 out:
 
 out:

-       if (mac_late)
+       if (mac_late) {

                mac_policy_release_exclusive();
                mac_policy_release_exclusive();

+       }

 
 

-       return (error);
+       return error;

 }
 
 int
 }
 
 int


@@ -946,7 +802,7 @@ mac_policy_unregister(mac_policy_handle_t handle)
        mpc = mac_get_mpc(handle);
        if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
                mac_policy_release_exclusive();
        mpc = mac_get_mpc(handle);
        if ((mpc->mpc_runtime_flags & MPC_RUNTIME_FLAG_REGISTERED) == 0) {
                mac_policy_release_exclusive();

-               return (0);
+               return 0;

        }
 
 #if 0
        }
 
 #if 0


@@ -955,7 +811,7 @@ mac_policy_unregister(mac_policy_handle_t handle)
         */
        if (mpc->mpc_field_off != NULL) {
                MAC_POLICY_LIST_UNLOCK();
         */
        if (mpc->mpc_field_off != NULL) {
                MAC_POLICY_LIST_UNLOCK();

-               return (EBUSY);
+               return EBUSY;

        }
 #endif
        /*
        }
 #endif
        /*


@@ -964,26 +820,29 @@ mac_policy_unregister(mac_policy_handle_t handle)
         */
        if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
                mac_policy_release_exclusive();
         */
        if ((mpc->mpc_loadtime_flags & MPC_LOADTIME_FLAG_UNLOADOK) == 0) {
                mac_policy_release_exclusive();

-               return (EBUSY);
+               return EBUSY;

        }
 
        mac_policy_removefrom_labellist(handle);
 
        mac_get_mpc(handle) = NULL;
        if (handle < mac_policy_list.freehint &&
        }
 
        mac_policy_removefrom_labellist(handle);
 
        mac_get_mpc(handle) = NULL;
        if (handle < mac_policy_list.freehint &&

-           handle >= mac_policy_list.staticmax)
+           handle >= mac_policy_list.staticmax) {

                mac_policy_list.freehint = handle;
                mac_policy_list.freehint = handle;

+       }

 
 

-       if (handle == mac_policy_list.maxindex)
+       if (handle == mac_policy_list.maxindex) {

                mac_policy_list.maxindex--;
                mac_policy_list.maxindex--;

+       }

 
 

-       mac_policy_list.numloaded--; 
+       mac_policy_list.numloaded--;

        if (mpc->mpc_field_off != NULL) {
                mac_slot_offsets_free |= (1 << *mpc->mpc_field_off);
        }
 
        if (mpc->mpc_field_off != NULL) {
                mac_slot_offsets_free |= (1 << *mpc->mpc_field_off);
        }
 

-       if (mpc->mpc_ops->mpo_policy_destroy != NULL)
+       if (mpc->mpc_ops->mpo_policy_destroy != NULL) {

                (*(mpc->mpc_ops->mpo_policy_destroy))(mpc);
                (*(mpc->mpc_ops->mpo_policy_destroy))(mpc);

+       }

 
        mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
        mac_policy_updateflags();
 
        mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
        mac_policy_updateflags();


@@ -999,7 +858,7 @@ mac_policy_unregister(mac_policy_handle_t handle)
        printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
            mpc->mpc_name);
 
        printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
            mpc->mpc_name);
 

-       return (0);
+       return 0;

 }
 
 /*
 }
 
 /*


@@ -1009,40 +868,45 @@ mac_policy_unregister(mac_policy_handle_t handle)
 int
 mac_error_select(int error1, int error2)
 {
 int
 mac_error_select(int error1, int error2)
 {

-

        /* Certain decision-making errors take top priority. */
        /* Certain decision-making errors take top priority. */

-       if (error1 == EDEADLK || error2 == EDEADLK)
-               return (EDEADLK);
+       if (error1 == EDEADLK || error2 == EDEADLK) {
+               return EDEADLK;
+       }

 
        /* Invalid arguments should be reported where possible. */
 
        /* Invalid arguments should be reported where possible. */

-       if (error1 == EINVAL || error2 == EINVAL)
-               return (EINVAL);
+       if (error1 == EINVAL || error2 == EINVAL) {
+               return EINVAL;
+       }

 
        /* Precedence goes to "visibility", with both process and file. */
 
        /* Precedence goes to "visibility", with both process and file. */

-       if (error1 == ESRCH || error2 == ESRCH)
-               return (ESRCH);
+       if (error1 == ESRCH || error2 == ESRCH) {
+               return ESRCH;
+       }

 
 

-       if (error1 == ENOENT || error2 == ENOENT)
-               return (ENOENT);
+       if (error1 == ENOENT || error2 == ENOENT) {
+               return ENOENT;
+       }

 
        /* Precedence goes to DAC/MAC protections. */
 
        /* Precedence goes to DAC/MAC protections. */

-       if (error1 == EACCES || error2 == EACCES)
-               return (EACCES);
+       if (error1 == EACCES || error2 == EACCES) {
+               return EACCES;
+       }

 
        /* Precedence goes to privilege. */
 
        /* Precedence goes to privilege. */

-       if (error1 == EPERM || error2 == EPERM)
-               return (EPERM);
+       if (error1 == EPERM || error2 == EPERM) {
+               return EPERM;
+       }

 
        /* Precedence goes to error over success; otherwise, arbitrary. */
 
        /* Precedence goes to error over success; otherwise, arbitrary. */

-       if (error1 != 0)
-               return (error1);
-       return (error2);
+       if (error1 != 0) {
+               return error1;
+       }
+       return error2;

 }
 
 void
 mac_label_init(struct label *label)
 {
 }
 
 void
 mac_label_init(struct label *label)
 {

-

        bzero(label, sizeof(*label));
        label->l_flags = MAC_FLAG_INITIALIZED;
 }
        bzero(label, sizeof(*label));
        label->l_flags = MAC_FLAG_INITIALIZED;
 }


@@ -1050,7 +914,6 @@ mac_label_init(struct label *label)
 void
 mac_label_destroy(struct label *label)
 {
 void
 mac_label_destroy(struct label *label)
 {

-

        KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
            ("destroying uninitialized label"));
 
        KASSERT(label->l_flags & MAC_FLAG_INITIALIZED,
            ("destroying uninitialized label"));
 


@@ -1058,34 +921,14 @@ mac_label_destroy(struct label *label)
        /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
 }
 
        /* implicit: label->l_flags &= ~MAC_FLAG_INITIALIZED; */
 }
 

-int
-mac_port_check_service (struct label *subj, struct label *obj,
-    const char *s, const char *p)
-{
-       int error;
-
-       MAC_CHECK(port_check_service, subj, obj, s, p);
-       return (error);
-}
-
-int
-mac_port_label_compute(struct label *subj, struct label *obj,
-    const char *s, struct label *out)
-{
-       int error;
-
-       MAC_CHECK(port_label_compute, subj, obj, s, out);
-       return error;
-}
-

 int
 mac_check_structmac_consistent(struct user_mac *mac)
 {
 int
 mac_check_structmac_consistent(struct user_mac *mac)
 {

+       if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN || mac->m_buflen == 0) {
+               return EINVAL;
+       }

 
 

-       if (mac->m_buflen > MAC_MAX_LABEL_BUF_LEN || mac->m_buflen == 0)
-               return (EINVAL);
-
-       return (0);
+       return 0;

 }
 
 /*
 }
 
 /*


@@ -1104,42 +947,52 @@ mac_label_externalize(size_t mpo_externalize_off, struct label *label,
        const char *name;
        int (*mpo_externalize)(struct label *, char *, struct sbuf *);
        int all_labels = 0, ignorenotfound = 0, error = 0, busy = FALSE;
        const char *name;
        int (*mpo_externalize)(struct label *, char *, struct sbuf *);
        int all_labels = 0, ignorenotfound = 0, error = 0, busy = FALSE;

+       int sb_pos;

        unsigned int count = 0;
 
        if (element[0] == '?') {
                element++;
                ignorenotfound = 1;
        unsigned int count = 0;
 
        if (element[0] == '?') {
                element++;
                ignorenotfound = 1;

-       } else if (element[0] == '*' && element[1] == '\0')
+       } else if (element[0] == '*' && element[1] == '\0') {

                all_labels = 1;
                all_labels = 1;

+       }

 
        element_list = &mac_static_label_element_list;
 element_loop:
        LIST_FOREACH(mle, element_list, mle_list) {
                name = mle->mle_name;
                if (all_labels) {
 
        element_list = &mac_static_label_element_list;
 element_loop:
        LIST_FOREACH(mle, element_list, mle_list) {
                name = mle->mle_name;
                if (all_labels) {

-                       if (*name == '?')
-                           continue;
+                       if (*name == '?') {
+                               continue;
+                       }

                } else {
                } else {

-                       if (*name == '?')
+                       if (*name == '?') {

                                name++;
                                name++;

-                       if (strcmp(name, element) != 0)
+                       }
+                       if (strcmp(name, element) != 0) {

                                continue;
                                continue;

+                       }

                }
                LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
                        mpc = mac_policy_list.entries[mll->mll_handle].mpc;
                }
                LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
                        mpc = mac_policy_list.entries[mll->mll_handle].mpc;

-                       if (mpc == NULL)
+                       if (mpc == NULL) {

                                continue;
                                continue;

-                       mpo_externalize = *(typeof(mpo_externalize) *)
-                           ((char *)mpc->mpc_ops + mpo_externalize_off);
-                       if (mpo_externalize == NULL)
+                       }
+                       mpo_externalize = *(const typeof(mpo_externalize) *)
+                           ((const char *)mpc->mpc_ops + mpo_externalize_off);
+                       if (mpo_externalize == NULL) {

                                continue;
                                continue;

+                       }
+                       sb_pos = sbuf_len(sb);

                        error = sbuf_printf(sb, "%s/", name);
                        error = sbuf_printf(sb, "%s/", name);

-                       if (error)
+                       if (error) {

                                goto done;
                                goto done;

+                       }

                        error = mpo_externalize(label, mle->mle_name, sb);
                        if (error) {
                        error = mpo_externalize(label, mle->mle_name, sb);
                        if (error) {

-                               if (error != ENOENT)
+                               if (error != ENOENT) {

                                        goto done;
                                        goto done;

+                               }

                                /*
                                 * If a policy doesn't have a label to
                                 * externalize it returns ENOENT.  This
                                /*
                                 * If a policy doesn't have a label to
                                 * externalize it returns ENOENT.  This


@@ -1147,14 +1000,14 @@ element_loop:
                                 * multiple label elements for some
                                 * (but not all) object types.
                                 */
                                 * multiple label elements for some
                                 * (but not all) object types.
                                 */

-                               sbuf_setpos(sb, sbuf_len(sb) -
-                                   (strlen(name) + 1));
+                               sbuf_setpos(sb, sb_pos);

                                error = 0;
                                continue;
                        }
                        error = sbuf_putc(sb, ',');
                                error = 0;
                                continue;
                        }
                        error = sbuf_putc(sb, ',');

-                       if (error)
+                       if (error) {

                                goto done;
                                goto done;

+                       }

                        count++;
                }
        }
                        count++;
                }
        }


@@ -1165,38 +1018,80 @@ element_loop:
                goto element_loop;
        }
 done:
                goto element_loop;
        }
 done:

-       if (busy)
+       if (busy) {

                mac_policy_list_unbusy();
                mac_policy_list_unbusy();

+       }

        if (!error && count == 0) {
        if (!error && count == 0) {

-               if (!all_labels && !ignorenotfound)
-                       error = ENOENT; /* XXX: ENOLABEL? */
+               if (!all_labels && !ignorenotfound) {
+                       error = ENOENT; /* XXX: ENOLABEL? */
+               }

        }
        }

-       return (error);
+       return error;

 }
 
 /*
  * Get the external forms of labels from all policies, for all label
  * namespaces contained in a list.
 }
 
 /*
  * Get the external forms of labels from all policies, for all label
  * namespaces contained in a list.

+ *
+ * XXX This may be leaking an sbuf.

  */
 int
 mac_externalize(size_t mpo_externalize_off, struct label *label,
     const char *elementlist, char *outbuf, size_t outbuflen)
 {
        char *element;
  */
 int
 mac_externalize(size_t mpo_externalize_off, struct label *label,
     const char *elementlist, char *outbuf, size_t outbuflen)
 {
        char *element;

+       char *scratch_base;
+       char *scratch;

        struct sbuf sb;
        int error = 0, len;
 
        struct sbuf sb;
        int error = 0, len;
 

-       sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);
-       while ((element = strsep(&elementlist, ",")) != NULL) {
+       /* allocate a scratch buffer the size of the string */
+       MALLOC(scratch_base, char *, strlen(elementlist) + 1, M_MACTEMP, M_WAITOK);
+       if (scratch_base == NULL) {
+               error = ENOMEM;
+               goto out;
+       }
+
+       /* copy the elementlist to the scratch buffer */
+       strlcpy(scratch_base, elementlist, strlen(elementlist) + 1);
+
+       /*
+        * set up a temporary pointer that can be used to iterate the
+        * scratch buffer without losing the allocation address
+        */
+       scratch = scratch_base;
+
+       /*
+        * initialize an sbuf mapping over the output buffer (or newly-allocated internal buffer, if
+        * outbuf is NULL), up to sbuf's limit of INT_MAX.
+        */
+       if (outbuflen > INT_MAX) {
+               outbuflen = INT_MAX;
+       }
+       if (sbuf_new(&sb, outbuf, (int)outbuflen, SBUF_FIXEDLEN) == NULL) {
+               /* could not allocate interior buffer */
+               error = ENOMEM;
+               goto out;
+       }
+       /* iterate the scratch buffer; NOTE: buffer contents modified! */
+       while ((element = strsep(&scratch, ",")) != NULL) {

                error = mac_label_externalize(mpo_externalize_off, label,
                    element, &sb);
                error = mac_label_externalize(mpo_externalize_off, label,
                    element, &sb);

-               if (error)
+               if (error) {

                        break;
                        break;

+               }
+       }
+       if ((len = sbuf_len(&sb)) > 0) {
+               sbuf_setpos(&sb, len - 1);      /* trim trailing comma */

        }
        }

-       if ((len = sbuf_len(&sb)) > 0)
-               sbuf_setpos(&sb, len - 1);      /* trim trailing comma */

        sbuf_finish(&sb);
        sbuf_finish(&sb);

-       return (error);
+
+out:
+       if (scratch_base != NULL) {
+               FREE(scratch_base, M_MACTEMP);
+       }
+
+       return error;

 }
 
 /*
 }
 
 /*


@@ -1219,22 +1114,27 @@ mac_label_internalize(size_t mpo_internalize_off, struct label *label,
        element_list = &mac_static_label_element_list;
 element_loop:
        LIST_FOREACH(mle, element_list, mle_list) {
        element_list = &mac_static_label_element_list;
 element_loop:
        LIST_FOREACH(mle, element_list, mle_list) {

-               if (*(name = mle->mle_name) == '?')
+               if (*(name = mle->mle_name) == '?') {

                        name++;
                        name++;

-               if (strcmp(element_name, name) != 0)
+               }
+               if (strcmp(element_name, name) != 0) {

                        continue;
                        continue;

+               }

                LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
                        mpc = mac_policy_list.entries[mll->mll_handle].mpc;
                LIST_FOREACH(mll, &mle->mle_listeners, mll_list) {
                        mpc = mac_policy_list.entries[mll->mll_handle].mpc;

-                       if (mpc == NULL)
+                       if (mpc == NULL) {

                                continue;
                                continue;

-                       mpo_internalize = *(typeof(mpo_internalize) *)
-                           ((char *)mpc->mpc_ops + mpo_internalize_off);
-                       if (mpo_internalize == NULL)
+                       }
+                       mpo_internalize = *(const typeof(mpo_internalize) *)
+                           ((const char *)mpc->mpc_ops + mpo_internalize_off);
+                       if (mpo_internalize == NULL) {

                                continue;
                                continue;

+                       }

                        error = mpo_internalize(label, element_name,
                            element_data);
                        error = mpo_internalize(label, element_name,
                            element_data);

-                       if (error)
+                       if (error) {

                                goto done;
                                goto done;

+                       }

                        count++;
                }
        }
                        count++;
                }
        }


@@ -1245,11 +1145,13 @@ element_loop:
                goto element_loop;
        }
 done:
                goto element_loop;
        }
 done:

-       if (busy)
+       if (busy) {

                mac_policy_list_unbusy();
                mac_policy_list_unbusy();

-       if (!error && count == 0)
+       }
+       if (!error && count == 0) {

                error = ENOPOLICY;
                error = ENOPOLICY;

-       return (error);
+       }
+       return error;

 }
 
 int
 }
 
 int


@@ -1269,13 +1171,13 @@ mac_internalize(size_t mpo_internalize_off, struct label *label,
                error = mac_label_internalize(mpo_internalize_off, label,
                    element_name, element_data);
        }
                error = mac_label_internalize(mpo_internalize_off, label,
                    element_name, element_data);
        }

-       return (error);
+       return error;

 }
 
 /* system calls */
 
 int
 }
 
 /* system calls */
 
 int

-__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __unused)
+__mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, int *ret __unused)

 {
        char *elements, *buffer;
        struct user_mac mac;
 {
        char *elements, *buffer;
        struct user_mac mac;


@@ -1286,23 +1188,29 @@ __mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __
 
        AUDIT_ARG(pid, uap->pid);
        if (IS_64BIT_PROCESS(p)) {
 
        AUDIT_ARG(pid, uap->pid);
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;
+       }
+       if (error) {
+               return error;

        }
        }

-       if (error)
-               return (error);

 
        error = mac_check_structmac_consistent(&mac);
 
        error = mac_check_structmac_consistent(&mac);

-       if (error)
-               return (error);
+       if (error) {
+               return error;
+       }

 
        tproc = proc_find(uap->pid);
 
        tproc = proc_find(uap->pid);

-       if (tproc == NULL)
-               return (ESRCH);
+       if (tproc == NULL) {
+               return ESRCH;
+       }

        tcred = kauth_cred_proc_ref(tproc);
        proc_rele(tproc);
 
        tcred = kauth_cred_proc_ref(tproc);
        proc_rele(tproc);
 


@@ -1311,24 +1219,25 @@ __mac_get_pid(struct proc *p, struct __mac_get_pid_args *uap, register_t *ret __
        if (error) {
                FREE(elements, M_MACTEMP);
                kauth_cred_unref(&tcred);
        if (error) {
                FREE(elements, M_MACTEMP);
                kauth_cred_unref(&tcred);

-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, elements);
 
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
        error = mac_cred_label_externalize(tcred->cr_label, elements,
            buffer, mac.m_buflen, M_WAITOK);
        }
        AUDIT_ARG(mac_string, elements);
 
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
        error = mac_cred_label_externalize(tcred->cr_label, elements,
            buffer, mac.m_buflen, M_WAITOK);

-       if (error == 0)
-               error = copyout(buffer, mac.m_string, strlen(buffer)+1);
+       if (error == 0) {
+               error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
+       }

 
        FREE(buffer, M_MACTEMP);
        FREE(elements, M_MACTEMP);
        kauth_cred_unref(&tcred);
 
        FREE(buffer, M_MACTEMP);
        FREE(elements, M_MACTEMP);
        kauth_cred_unref(&tcred);

-       return (error);
+       return error;

 }
 
 int
 }
 
 int

-__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unused)
+__mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, int *ret __unused)

 {
        char *elements, *buffer;
        struct user_mac mac;
 {
        char *elements, *buffer;
        struct user_mac mac;


@@ -1337,25 +1246,30 @@ __mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unus
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;
+       }
+       if (error) {
+               return error;

        }
        }

-       if (error)
-               return (error);

 
        error = mac_check_structmac_consistent(&mac);
 
        error = mac_check_structmac_consistent(&mac);

-       if (error)
-               return (error);
+       if (error) {
+               return error;
+       }

 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
                FREE(elements, M_MACTEMP);
 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
                FREE(elements, M_MACTEMP);

-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, elements);
 
        }
        AUDIT_ARG(mac_string, elements);
 


@@ -1364,23 +1278,19 @@ __mac_get_proc(proc_t p, struct __mac_get_proc_args *uap, register_t *ret __unus
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
        error = mac_cred_label_externalize(cr->cr_label,
            elements, buffer, mac.m_buflen, M_WAITOK);
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
        error = mac_cred_label_externalize(cr->cr_label,
            elements, buffer, mac.m_buflen, M_WAITOK);

-       if (error == 0)
-               error = copyout(buffer, mac.m_string, strlen(buffer)+1);
+       if (error == 0) {
+               error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
+       }

 
        FREE(buffer, M_MACTEMP);
        FREE(elements, M_MACTEMP);
        kauth_cred_unref(&cr);
 
        FREE(buffer, M_MACTEMP);
        FREE(elements, M_MACTEMP);
        kauth_cred_unref(&cr);

-       return (error);
+       return error;

 }
 
 }
 

-/*
- * MPSAFE
- */
-

 int
 int

-__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, register_t *ret __unused)
+__mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, int *ret __unused)

 {
 {

-       kauth_cred_t newcred, oldcred;

        struct label *intlabel;
        struct user_mac mac;
        char *buffer;
        struct label *intlabel;
        struct user_mac mac;
        char *buffer;


@@ -1388,33 +1298,39 @@ __mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, register_t *ret __unus
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;
+       }
+       if (error) {
+               return error;

        }
        }

-       if (error)
-               return (error);

 
        error = mac_check_structmac_consistent(&mac);
 
        error = mac_check_structmac_consistent(&mac);

-       if (error)
-               return (error);
+       if (error) {
+               return error;
+       }

 
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
        if (error) {
                FREE(buffer, M_MACTEMP);
 
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
        if (error) {
                FREE(buffer, M_MACTEMP);

-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, buffer);
 
        intlabel = mac_cred_label_alloc();
        error = mac_cred_label_internalize(intlabel, buffer);
        FREE(buffer, M_MACTEMP);
        }
        AUDIT_ARG(mac_string, buffer);
 
        intlabel = mac_cred_label_alloc();
        error = mac_cred_label_internalize(intlabel, buffer);
        FREE(buffer, M_MACTEMP);

-       if (error)
+       if (error) {

                goto out;
                goto out;

+       }

 
        error = mac_cred_check_label_update(kauth_cred_get(), intlabel);
        if (error) {
 
        error = mac_cred_check_label_update(kauth_cred_get(), intlabel);
        if (error) {


@@ -1422,248 +1338,55 @@ __mac_set_proc(proc_t p, struct __mac_set_proc_args *uap, register_t *ret __unus
        }
 
        error = kauth_proc_label_update(p, intlabel);
        }
 
        error = kauth_proc_label_update(p, intlabel);

-       if (error)
+       if (error) {

                goto out;
                goto out;

-
-       newcred = kauth_cred_proc_ref(p);
-       mac_task_label_update_cred(newcred, p->task);
-
-#if 0
-       if (mac_vm_enforce) {
-               mutex_lock(Giant);                      /* XXX FUNNEL? */
-               mac_cred_mmapped_drop_perms(p, newcred);
-               mutex_unlock(Giant);                    /* XXX FUNNEL? */

        }
        }

-#endif

 
 

-       kauth_cred_unref(&newcred);

 out:
        mac_cred_label_free(intlabel);
 out:
        mac_cred_label_free(intlabel);

-       return (error);
+       return error;

 }
 
 }
 

-#if CONFIG_LCTX

 int
 int

-__mac_get_lcid(proc_t p, struct __mac_get_lcid_args *uap, register_t *ret __unused)
+__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, int *ret __unused)

 {
 {

-       char *elements, *buffer;
+       struct fileproc *fp;
+       struct vnode *vp;

        struct user_mac mac;
        struct user_mac mac;

-       struct lctx *l;
+       char *elements, *buffer;

        int error;
        size_t ulen;
        int error;
        size_t ulen;

+       kauth_cred_t my_cred;
+       struct label *intlabel;
+
+       AUDIT_ARG(fd, uap->fd);

 
 

-       AUDIT_ARG(value, uap->lcid);

        if (IS_64BIT_PROCESS(p)) {
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
 
        }
 

-       if (error)
-               return (error);
+       if (error) {
+               return error;
+       }

 
        error = mac_check_structmac_consistent(&mac);
 
        error = mac_check_structmac_consistent(&mac);

-       if (error)
-               return (error);
-
-       l = lcfind(uap->lcid);
-       if (l == NULL)
-               return (ESRCH);
-
-       MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
-       error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);

        if (error) {
        if (error) {

-               LCTX_UNLOCK(l);
-               FREE(elements, M_MACTEMP);
-               return (error);
+               return error;

        }
        }

-       AUDIT_ARG(mac_string, elements);
-       MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
-       error = mac_lctx_label_externalize(l->lc_label, elements,
-                                          buffer, mac.m_buflen);
-       if (error == 0)
-               error = copyout(buffer, mac.m_string, strlen(buffer)+1);
-
-       LCTX_UNLOCK(l);
-       FREE(buffer, M_MACTEMP);
-       FREE(elements, M_MACTEMP);
-       return (error);
-}
-
-int
-__mac_get_lctx(proc_t p, struct __mac_get_lctx_args *uap, register_t *ret __unused)
-{
-       char *elements, *buffer;
-       struct user_mac mac;
-       int error;
-       size_t ulen;
-
-       if (IS_64BIT_PROCESS(p)) {
-               error = copyin(uap->mac_p, &mac, sizeof(mac));
-       } else {
-               struct mac mac32;
-               error = copyin(uap->mac_p, &mac32, sizeof(mac32));
-               mac.m_buflen = mac32.m_buflen;
-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
-       }
-
-       if (error)
-               return (error);
-
-       error = mac_check_structmac_consistent(&mac);
-       if (error)
-               return (error);

 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
                FREE(elements, M_MACTEMP);
 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
                FREE(elements, M_MACTEMP);

-               return (error);
-       }
-       AUDIT_ARG(mac_string, elements);
-       MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
-
-       proc_lock(p);
-       if (p->p_lctx == NULL) {
-               proc_unlock(p);
-               error = ENOENT;
-               goto out;
-       }
-
-       error = mac_lctx_label_externalize(p->p_lctx->lc_label,
-                                          elements, buffer, mac.m_buflen);
-       proc_unlock(p);
-       if (error == 0)
-               error = copyout(buffer, mac.m_string, strlen(buffer)+1);
-
-out:
-       FREE(buffer, M_MACTEMP);
-       FREE(elements, M_MACTEMP);
-       return (error);
-}
-
-int
-__mac_set_lctx(proc_t p, struct __mac_set_lctx_args *uap, register_t *ret __unused)
-{
-       struct user_mac mac;
-       struct label *intlabel;
-       char *buffer;
-       int error;
-       size_t ulen;
-
-       if (IS_64BIT_PROCESS(p)) {
-               error = copyin(uap->mac_p, &mac, sizeof(mac));
-       } else {
-               struct mac mac32;
-               error = copyin(uap->mac_p, &mac32, sizeof(mac32));
-               mac.m_buflen = mac32.m_buflen;
-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
-       }
-       if (error)
-               return (error);
-
-       error = mac_check_structmac_consistent(&mac);
-       if (error)
-               return (error);
-
-       MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
-       error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
-       if (error) {
-               FREE(buffer, M_MACTEMP);
-               return (error);
-       }
-       AUDIT_ARG(mac_string, buffer);
-
-       intlabel = mac_lctx_label_alloc();
-       error = mac_lctx_label_internalize(intlabel, buffer);
-       FREE(buffer, M_MACTEMP);
-       if (error)
-               goto out;
-
-       proc_lock(p);
-       if (p->p_lctx == NULL) {
-               proc_unlock(p);
-               error = ENOENT;
-               goto out;
-       }
-
-       error = mac_lctx_check_label_update(p->p_lctx, intlabel);
-       if (error) {
-               proc_unlock(p);
-               goto out;
-       }
-       mac_lctx_label_update(p->p_lctx, intlabel);
-       proc_unlock(p);
-out:
-       mac_lctx_label_free(intlabel);
-       return (error);
-}
-
-#else  /* LCTX */
-
-int
-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
-{
-
-       return (ENOSYS);
-}
-
-int
-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
-{
-
-       return (ENOSYS);
-}
-
-int
-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
-{
-
-       return (ENOSYS);
-}
-#endif /* !LCTX */
-
-int
-__mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
-{
-       struct fileproc *fp;
-       struct vnode *vp;
-       struct user_mac mac;
-       char *elements, *buffer;
-       int error;
-       size_t ulen;
-       kauth_cred_t my_cred;
-#if CONFIG_MACF_SOCKET
-       struct socket *so;
-#endif /* MAC_SOCKET */
-       struct label *intlabel;
-
-       AUDIT_ARG(fd, uap->fd);
-
-       if (IS_64BIT_PROCESS(p)) {
-               error = copyin(uap->mac_p, &mac, sizeof(mac));
-       } else {
-               struct mac mac32;
-               error = copyin(uap->mac_p, &mac32, sizeof(mac32));
-               mac.m_buflen = mac32.m_buflen;
-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
-       }
-
-       if (error) 
-               return (error);
-
-       error = mac_check_structmac_consistent(&mac);
-       if (error)
-               return (error);
-                       
-       MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
-       error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
-       if (error) {
-               FREE(elements, M_MACTEMP);
-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, elements);
 
        }
        AUDIT_ARG(mac_string, elements);
 


@@ -1672,68 +1395,60 @@ __mac_get_fd(proc_t p, struct __mac_get_fd_args *uap, register_t *ret __unused)
        if (error) {
                FREE(buffer, M_MACTEMP);
                FREE(elements, M_MACTEMP);
        if (error) {
                FREE(buffer, M_MACTEMP);
                FREE(elements, M_MACTEMP);

-               return (error);
+               return error;

        }
        }

-       
+

        my_cred = kauth_cred_proc_ref(p);
        my_cred = kauth_cred_proc_ref(p);

-       error = mac_file_check_get(my_cred, fp->f_fglob, elements, mac.m_buflen);
+       error = mac_file_check_get(my_cred, fp->fp_glob, elements, mac.m_buflen);

        kauth_cred_unref(&my_cred);
        if (error) {
                fp_drop(p, uap->fd, fp, 0);
                FREE(buffer, M_MACTEMP);
                FREE(elements, M_MACTEMP);
        kauth_cred_unref(&my_cred);
        if (error) {
                fp_drop(p, uap->fd, fp, 0);
                FREE(buffer, M_MACTEMP);
                FREE(elements, M_MACTEMP);

-               return (error);
-       }
-       
-       switch (fp->f_fglob->fg_type) {
-               case DTYPE_VNODE:
-
-                       intlabel = mac_vnode_label_alloc();
-                       vp = (struct vnode *)fp->f_fglob->fg_data;
-
-                       error = vnode_getwithref(vp);
-                       if (error == 0) {
-                               mac_vnode_label_copy(vp->v_label, intlabel);
-                               error = mac_vnode_label_externalize(intlabel,
-                                               elements, buffer,
-                                               mac.m_buflen, M_WAITOK);
-                               vnode_put(vp);
-                       }
-                       mac_vnode_label_free(intlabel);
-                       break;
-               case DTYPE_SOCKET:
-#if CONFIG_MACF_SOCKET
-                       so = (struct socket *) fp->f_fglob->fg_data;
-                       intlabel = mac_socket_label_alloc(MAC_WAITOK);
-                       sock_lock(so, 1);
-                       mac_socket_label_copy(so->so_label, intlabel);
-                       sock_unlock(so, 1);
-                       error = mac_socket_label_externalize(intlabel, elements, buffer, mac.m_buflen);
-                       mac_socket_label_free(intlabel);
-                       break;
-#endif
-               case DTYPE_PSXSHM:
-               case DTYPE_PSXSEM:
-               case DTYPE_PIPE:
-               case DTYPE_KQUEUE:
-               case DTYPE_FSEVENTS:
-               default:
-                       error = ENOSYS;   // only sockets/vnodes so far
+               return error;
+       }
+
+       switch (FILEGLOB_DTYPE(fp->fp_glob)) {
+       case DTYPE_VNODE:
+               intlabel = mac_vnode_label_alloc();
+               if (intlabel == NULL) {
+                       error = ENOMEM;

                        break;
                        break;

+               }
+               vp = (struct vnode *)fp->fp_glob->fg_data;
+               error = vnode_getwithref(vp);
+               if (error == 0) {
+                       mac_vnode_label_copy(vp->v_label, intlabel);
+                       error = mac_vnode_label_externalize(intlabel,
+                           elements, buffer,
+                           mac.m_buflen, M_WAITOK);
+                       vnode_put(vp);
+               }
+               mac_vnode_label_free(intlabel);
+               break;
+       case DTYPE_SOCKET:
+       case DTYPE_PSXSHM:
+       case DTYPE_PSXSEM:
+       case DTYPE_PIPE:
+       case DTYPE_KQUEUE:
+       case DTYPE_FSEVENTS:
+       case DTYPE_ATALK:
+       case DTYPE_NETPOLICY:
+       default:
+               error = ENOSYS;           // only sockets/vnodes so far
+               break;

        }
        fp_drop(p, uap->fd, fp, 0);
        }
        fp_drop(p, uap->fd, fp, 0);

-       
-       if (error == 0)
-               error = copyout(buffer, mac.m_string, strlen(buffer)+1);
-               
+
+       if (error == 0) {
+               error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
+       }
+

        FREE(buffer, M_MACTEMP);
        FREE(elements, M_MACTEMP);
        FREE(buffer, M_MACTEMP);
        FREE(elements, M_MACTEMP);

-       return (error);
+       return error;

 }
 
 }
 

-/*
- * MPSAFE
- */

 static int
 mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
 {
 static int
 mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
 {


@@ -1747,38 +1462,47 @@ mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;

        }
 
        }
 

-       if (error)
-               return (error);
+       if (error) {
+               return error;
+       }

 
        error = mac_check_structmac_consistent(&mac);
 
        error = mac_check_structmac_consistent(&mac);

-       if (error)
-               return (error);
+       if (error) {
+               return error;
+       }

 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);

+       MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
+

        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {

+               FREE(buffer, M_MACTEMP);

                FREE(elements, M_MACTEMP);
                FREE(elements, M_MACTEMP);

-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, elements);
 
        ctx = vfs_context_current();
 
        }
        AUDIT_ARG(mac_string, elements);
 
        ctx = vfs_context_current();
 

-       NDINIT(&nd, LOOKUP,
-               LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
-               UIO_USERSPACE, path_p, ctx);
+       NDINIT(&nd, LOOKUP, OP_LOOKUP,
+           LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
+           UIO_USERSPACE, path_p, ctx);

        error = namei(&nd);
        if (error) {
        error = namei(&nd);
        if (error) {

+               FREE(buffer, M_MACTEMP);

                FREE(elements, M_MACTEMP);
                FREE(elements, M_MACTEMP);

-               return (error);
+               return error;

        }
        vp = nd.ni_vp;
 
        }
        vp = nd.ni_vp;
 


@@ -1786,42 +1510,38 @@ mac_get_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p, int follow)
 
        intlabel = mac_vnode_label_alloc();
        mac_vnode_label_copy(vp->v_label, intlabel);
 
        intlabel = mac_vnode_label_alloc();
        mac_vnode_label_copy(vp->v_label, intlabel);

-
-       MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);

        error = mac_vnode_label_externalize(intlabel, elements, buffer,
        error = mac_vnode_label_externalize(intlabel, elements, buffer,

-                                           mac.m_buflen, M_WAITOK);
-       FREE(elements, M_MACTEMP);
-
-       if (error == 0)
+           mac.m_buflen, M_WAITOK);
+       mac_vnode_label_free(intlabel);
+       if (error == 0) {

                error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
                error = copyout(buffer, mac.m_string, strlen(buffer) + 1);

-       FREE(buffer, M_MACTEMP);
+       }

 
        vnode_put(vp);
 
        vnode_put(vp);

-       mac_vnode_label_free(intlabel);

 
 

-       return (error);
+       FREE(buffer, M_MACTEMP);
+       FREE(elements, M_MACTEMP);
+
+       return error;

 }
 
 int
 __mac_get_file(proc_t p, struct __mac_get_file_args *uap,
 }
 
 int
 __mac_get_file(proc_t p, struct __mac_get_file_args *uap,

-              register_t *ret __unused)
+    int *ret __unused)

 {
 {

-
-       return (mac_get_filelink(p, uap->mac_p, uap->path_p, 1));
+       return mac_get_filelink(p, uap->mac_p, uap->path_p, 1);

 }
 
 int
 __mac_get_link(proc_t p, struct __mac_get_link_args *uap,
 }
 
 int
 __mac_get_link(proc_t p, struct __mac_get_link_args *uap,

-              register_t *ret __unused)
+    int *ret __unused)

 {
 {

-
-       return (mac_get_filelink(p, uap->mac_p, uap->path_p, 0));
+       return mac_get_filelink(p, uap->mac_p, uap->path_p, 0);

 }
 
 int
 }
 
 int

-__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
+__mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, int *ret __unused)

 {
 {

-

        struct fileproc *fp;
        struct user_mac mac;
        struct vfs_context *ctx = vfs_context_current();
        struct fileproc *fp;
        struct user_mac mac;
        struct vfs_context *ctx = vfs_context_current();


@@ -1829,108 +1549,101 @@ __mac_set_fd(proc_t p, struct __mac_set_fd_args *uap, register_t *ret __unused)
        size_t ulen;
        char *buffer;
        struct label *intlabel;
        size_t ulen;
        char *buffer;
        struct label *intlabel;

-#if CONFIG_MACF_SOCKET
-       struct socket *so;
-#endif

        struct vnode *vp;
 
        AUDIT_ARG(fd, uap->fd);
 
        if (IS_64BIT_PROCESS(p)) {
        struct vnode *vp;
 
        AUDIT_ARG(fd, uap->fd);
 
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(uap->mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(uap->mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(uap->mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;
+       }
+       if (error) {
+               return error;

        }
        }

-       if (error) 
-               return (error);
-               
+

        error = mac_check_structmac_consistent(&mac);
        error = mac_check_structmac_consistent(&mac);

-       if (error)
-               return (error);
-       
+       if (error) {
+               return error;
+       }
+

        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
        if (error) {
                FREE(buffer, M_MACTEMP);
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
        if (error) {
                FREE(buffer, M_MACTEMP);

-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, buffer);
        }
        AUDIT_ARG(mac_string, buffer);

-       
+

        error = fp_lookup(p, uap->fd, &fp, 0);
        if (error) {
                FREE(buffer, M_MACTEMP);
        error = fp_lookup(p, uap->fd, &fp, 0);
        if (error) {
                FREE(buffer, M_MACTEMP);

-               return (error);
+               return error;

        }
        }

-       

 
 

-       error = mac_file_check_set(vfs_context_ucred(ctx), fp->f_fglob, buffer, mac.m_buflen);
+
+       error = mac_file_check_set(vfs_context_ucred(ctx), fp->fp_glob, buffer, mac.m_buflen);

        if (error) {
                fp_drop(p, uap->fd, fp, 0);
                FREE(buffer, M_MACTEMP);
        if (error) {
                fp_drop(p, uap->fd, fp, 0);
                FREE(buffer, M_MACTEMP);

-               return (error);
+               return error;

        }
        }

-       
-       switch (fp->f_fglob->fg_type) {
-
-               case DTYPE_VNODE:
-                       intlabel = mac_vnode_label_alloc();
-
-                       error = mac_vnode_label_internalize(intlabel, buffer);
-                       if (error) {
-                               mac_vnode_label_free(intlabel);
-                               break;
-                       }

 
 

+       switch (FILEGLOB_DTYPE(fp->fp_glob)) {
+       case DTYPE_VNODE:
+               if (mac_label_vnodes == 0) {
+                       error = ENOSYS;
+                       break;
+               }

 
 

-                       vp = (struct vnode *)fp->f_fglob->fg_data;
+               intlabel = mac_vnode_label_alloc();

 
 

-                       error = vnode_getwithref(vp);
-                       if (error == 0) {
-                               error = vn_setlabel(vp, intlabel, ctx);
-                               vnode_put(vp);
-                       }
+               error = mac_vnode_label_internalize(intlabel, buffer);
+               if (error) {

                        mac_vnode_label_free(intlabel);
                        break;
                        mac_vnode_label_free(intlabel);
                        break;

+               }

 
 

-               case DTYPE_SOCKET:
-#if CONFIG_MACF_SOCKET
-                       intlabel = mac_socket_label_alloc(MAC_WAITOK);
-                       error = mac_socket_label_internalize(intlabel, buffer);
-                       if (error == 0) {
-                               so = (struct socket *) fp->f_fglob->fg_data;
-                               SOCK_LOCK(so);
-                               error = mac_socket_label_update(vfs_context_ucred(ctx), so, intlabel);
-                               SOCK_UNLOCK(so);
-                       }
-                       mac_socket_label_free(intlabel);
-                       break;
-#endif
-               case DTYPE_PSXSHM:
-               case DTYPE_PSXSEM:
-               case DTYPE_PIPE:
-               case DTYPE_KQUEUE:
-               case DTYPE_FSEVENTS:
-               default:
-                       error = ENOSYS;  // only sockets/vnodes so far
-                       break;
+
+               vp = (struct vnode *)fp->fp_glob->fg_data;
+
+               error = vnode_getwithref(vp);
+               if (error == 0) {
+                       error = vn_setlabel(vp, intlabel, ctx);
+                       vnode_put(vp);
+               }
+               mac_vnode_label_free(intlabel);
+               break;
+
+       case DTYPE_SOCKET:
+       case DTYPE_PSXSHM:
+       case DTYPE_PSXSEM:
+       case DTYPE_PIPE:
+       case DTYPE_KQUEUE:
+       case DTYPE_FSEVENTS:
+       case DTYPE_ATALK:
+       case DTYPE_NETPOLICY:
+       default:
+               error = ENOSYS;          // only sockets/vnodes so far
+               break;

        }
 
        fp_drop(p, uap->fd, fp, 0);
        FREE(buffer, M_MACTEMP);
        }
 
        fp_drop(p, uap->fd, fp, 0);
        FREE(buffer, M_MACTEMP);

-       return (error);
+       return error;

 }
 
 }
 

-/*
- * MPSAFE
- */

 static int
 mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
 static int
 mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,

-                int follow)
+    int follow)

 {
 {

-       register struct vnode *vp;
+       struct vnode *vp;

        struct vfs_context *ctx = vfs_context_current();
        struct label *intlabel;
        struct nameidata nd;
        struct vfs_context *ctx = vfs_context_current();
        struct label *intlabel;
        struct nameidata nd;


@@ -1939,28 +1652,36 @@ mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
        int error;
        size_t ulen;
 
        int error;
        size_t ulen;
 

+       if (mac_label_vnodes == 0) {
+               return ENOSYS;
+       }
+

        if (IS_64BIT_PROCESS(p)) {
        if (IS_64BIT_PROCESS(p)) {

-               error = copyin(mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;
+       }
+       if (error) {
+               return error;

        }
        }

-       if (error)
-               return (error);

 
        error = mac_check_structmac_consistent(&mac);
        if (error) {
                printf("mac_set_file: failed structure consistency check\n");
 
        error = mac_check_structmac_consistent(&mac);
        if (error) {
                printf("mac_set_file: failed structure consistency check\n");

-               return (error);
+               return error;

        }
 
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
        if (error) {
                FREE(buffer, M_MACTEMP);
        }
 
        MALLOC(buffer, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, buffer, mac.m_buflen, &ulen);
        if (error) {
                FREE(buffer, M_MACTEMP);

-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, buffer);
 
        }
        AUDIT_ARG(mac_string, buffer);
 


@@ -1969,16 +1690,16 @@ mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
        FREE(buffer, M_MACTEMP);
        if (error) {
                mac_vnode_label_free(intlabel);
        FREE(buffer, M_MACTEMP);
        if (error) {
                mac_vnode_label_free(intlabel);

-               return (error);
+               return error;

        }
 
        }
 

-       NDINIT(&nd, LOOKUP,
-               LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
-               UIO_USERSPACE, path_p, ctx);
+       NDINIT(&nd, LOOKUP, OP_LOOKUP,
+           LOCKLEAF | (follow ? FOLLOW : NOFOLLOW) | AUDITVNPATH1,
+           UIO_USERSPACE, path_p, ctx);

        error = namei(&nd);
        if (error) {
                mac_vnode_label_free(intlabel);
        error = namei(&nd);
        if (error) {
                mac_vnode_label_free(intlabel);

-               return (error);
+               return error;

        }
        vp = nd.ni_vp;
 
        }
        vp = nd.ni_vp;
 


@@ -1988,31 +1709,40 @@ mac_set_filelink(proc_t p, user_addr_t mac_p, user_addr_t path_p,
        vnode_put(vp);
        mac_vnode_label_free(intlabel);
 
        vnode_put(vp);
        mac_vnode_label_free(intlabel);
 

-       return (error);
+       return error;

 }
 
 int
 __mac_set_file(proc_t p, struct __mac_set_file_args *uap,
 }
 
 int
 __mac_set_file(proc_t p, struct __mac_set_file_args *uap,

-              register_t *ret __unused)
+    int *ret __unused)

 {
 {

-
-       return (mac_set_filelink(p, uap->mac_p, uap->path_p, 1));
+       return mac_set_filelink(p, uap->mac_p, uap->path_p, 1);

 }
 
 int
 __mac_set_link(proc_t p, struct __mac_set_link_args *uap,
 }
 
 int
 __mac_set_link(proc_t p, struct __mac_set_link_args *uap,

-              register_t *ret __unused)
+    int *ret __unused)

 {
 {

-
-       return (mac_set_filelink(p, uap->mac_p, uap->path_p, 0));
+       return mac_set_filelink(p, uap->mac_p, uap->path_p, 0);

 }
 
 /*
 }
 
 /*

- * MPSAFE
+ * __mac_syscall: Perform a MAC policy system call
+ *
+ * Parameters:    p                       Process calling this routine
+ *                uap                     User argument descriptor (see below)
+ *                retv                    (Unused)
+ *
+ * Indirect:      uap->policy             Name of target MAC policy
+ *                uap->call               MAC policy-specific system call to perform
+ *                uap->arg                MAC policy-specific system call arguments
+ *
+ * Returns:        0                      Success
+ *                !0                      Not success
+ *

  */
  */

-

 int
 int

-__mac_syscall(proc_t p, struct __mac_syscall_args *uap, register_t *retv __unused)
+__mac_syscall(proc_t p, struct __mac_syscall_args *uap, int *retv __unused)

 {
        struct mac_policy_conf *mpc;
        char target[MAC_MAX_POLICY_NAME];
 {
        struct mac_policy_conf *mpc;
        char target[MAC_MAX_POLICY_NAME];


@@ -2021,30 +1751,33 @@ __mac_syscall(proc_t p, struct __mac_syscall_args *uap, register_t *retv __unuse
        size_t ulen;
 
        error = copyinstr(uap->policy, target, sizeof(target), &ulen);
        size_t ulen;
 
        error = copyinstr(uap->policy, target, sizeof(target), &ulen);

-       if (error)
-               return (error);
-       AUDIT_ARG(value, uap->call);
+       if (error) {
+               return error;
+       }
+       AUDIT_ARG(value32, uap->call);

        AUDIT_ARG(mac_string, target);
 
        error = ENOPOLICY;
 
        for (i = 0; i < mac_policy_list.staticmax; i++) {
                mpc = mac_policy_list.entries[i].mpc;
        AUDIT_ARG(mac_string, target);
 
        error = ENOPOLICY;
 
        for (i = 0; i < mac_policy_list.staticmax; i++) {
                mpc = mac_policy_list.entries[i].mpc;

-               if (mpc == NULL)
+               if (mpc == NULL) {

                        continue;
                        continue;

+               }

 
                if (strcmp(mpc->mpc_name, target) == 0 &&
                    mpc->mpc_ops->mpo_policy_syscall != NULL) {
                        error = mpc->mpc_ops->mpo_policy_syscall(p,
                            uap->call, uap->arg);
                        goto done;
 
                if (strcmp(mpc->mpc_name, target) == 0 &&
                    mpc->mpc_ops->mpo_policy_syscall != NULL) {
                        error = mpc->mpc_ops->mpo_policy_syscall(p,
                            uap->call, uap->arg);
                        goto done;

-               }
+               }

        }
        if (mac_policy_list_conditional_busy() != 0) {
                for (; i <= mac_policy_list.maxindex; i++) {
                        mpc = mac_policy_list.entries[i].mpc;
        }
        if (mac_policy_list_conditional_busy() != 0) {
                for (; i <= mac_policy_list.maxindex; i++) {
                        mpc = mac_policy_list.entries[i].mpc;

-                       if (mpc == NULL)
+                       if (mpc == NULL) {

                                continue;
                                continue;

+                       }

 
                        if (strcmp(mpc->mpc_name, target) == 0 &&
                            mpc->mpc_ops->mpo_policy_syscall != NULL) {
 
                        if (strcmp(mpc->mpc_name, target) == 0 &&
                            mpc->mpc_ops->mpo_policy_syscall != NULL) {


@@ -2057,7 +1790,7 @@ __mac_syscall(proc_t p, struct __mac_syscall_args *uap, register_t *retv __unuse
        }
 
 done:
        }
 
 done:

-       return (error);
+       return error;

 }
 
 int
 }
 
 int


@@ -2070,25 +1803,30 @@ mac_mount_label_get(struct mount *mp, user_addr_t mac_p)
        size_t ulen;
 
        if (IS_64BIT_PROCESS(current_proc())) {
        size_t ulen;
 
        if (IS_64BIT_PROCESS(current_proc())) {

-               error = copyin(mac_p, &mac, sizeof(mac));
+               struct user64_mac mac64;
+               error = copyin(mac_p, &mac64, sizeof(mac64));
+               mac.m_buflen = mac64.m_buflen;
+               mac.m_string = mac64.m_string;

        } else {
        } else {

-               struct mac mac32;
+               struct user32_mac mac32;

                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;
                error = copyin(mac_p, &mac32, sizeof(mac32));
                mac.m_buflen = mac32.m_buflen;

-               mac.m_string = CAST_USER_ADDR_T(mac32.m_string);
+               mac.m_string = mac32.m_string;
+       }
+       if (error) {
+               return error;

        }
        }

-       if (error)
-               return (error);

 
        error = mac_check_structmac_consistent(&mac);
 
        error = mac_check_structmac_consistent(&mac);

-       if (error)
-               return (error);
+       if (error) {
+               return error;
+       }

 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
                FREE(elements, M_MACTEMP);
 
        MALLOC(elements, char *, mac.m_buflen, M_MACTEMP, M_WAITOK);
        error = copyinstr(mac.m_string, elements, mac.m_buflen, &ulen);
        if (error) {
                FREE(elements, M_MACTEMP);

-               return (error);
+               return error;

        }
        AUDIT_ARG(mac_string, elements);
 
        }
        AUDIT_ARG(mac_string, elements);
 


@@ -2098,182 +1836,204 @@ mac_mount_label_get(struct mount *mp, user_addr_t mac_p)
            mac.m_buflen);
        FREE(elements, M_MACTEMP);
 
            mac.m_buflen);
        FREE(elements, M_MACTEMP);
 

-       if (error == 0)
+       if (error == 0) {

                error = copyout(buffer, mac.m_string, strlen(buffer) + 1);
                error = copyout(buffer, mac.m_string, strlen(buffer) + 1);

+       }

        FREE(buffer, M_MACTEMP);
 
        FREE(buffer, M_MACTEMP);
 

-       return (error);
+       return error;

 }
 
 }
 

+/*
+ * __mac_get_mount: Get mount point label information for a given pathname
+ *
+ * Parameters:    p                        (ignored)
+ *                uap                      User argument descriptor (see below)
+ *                ret                      (ignored)
+ *
+ * Indirect:      uap->path                Pathname
+ *                uap->mac_p               MAC info
+ *
+ * Returns:        0                       Success
+ *                !0                       Not success
+ */

 int
 __mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,
 int
 __mac_get_mount(proc_t p __unused, struct __mac_get_mount_args *uap,

-    register_t *ret __unused)
+    int *ret __unused)

 {
        struct nameidata nd;
        struct vfs_context *ctx = vfs_context_current();
        struct mount *mp;
        int error;
 
 {
        struct nameidata nd;
        struct vfs_context *ctx = vfs_context_current();
        struct mount *mp;
        int error;
 

-       NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNPATH1,
-               UIO_USERSPACE, uap->path, ctx);
+       NDINIT(&nd, LOOKUP, OP_LOOKUP, FOLLOW | AUDITVNPATH1,
+           UIO_USERSPACE, uap->path, ctx);

        error = namei(&nd);
        if (error) {
        error = namei(&nd);
        if (error) {

-               return (error);
+               return error;

        }
        mp = nd.ni_vp->v_mount;
        }
        mp = nd.ni_vp->v_mount;

+       mount_ref(mp, 0);
+       vnode_put(nd.ni_vp);

        nameidone(&nd);
 
        nameidone(&nd);
 

-       return mac_mount_label_get(mp, uap->mac_p);
+       error = mac_mount_label_get(mp, uap->mac_p);
+       mount_drop(mp, 0);
+       return error;

 }
 
 }
 

-#else /* MAC */
-
+/*
+ * mac_schedule_userret()
+ *
+ * Schedule a callback to the mpo_thread_userret hook. The mpo_thread_userret
+ * hook is called just before the thread exit from the kernel in ast_taken().
+ *
+ * Returns:     0              Success
+ *              !0             Not successful
+ */

 int
 int

-mac_policy_register(struct mac_policy_conf *mpc __unused, 
-       mac_policy_handle_t *handlep __unused, void *xd __unused)
+mac_schedule_userret(void)

 {
 {

-
-       return (0);
+       act_set_astmacf(current_thread());
+       return 0;

 }
 
 }
 

+/*
+ * mac_do_machexc()
+ *
+ * Do a Mach exception.  This should only be done in the mpo_thread_userret
+ * callback.
+ *
+ * params:     code            exception code
+ *              subcode                exception subcode
+ *              flags          flags:
+ *                              MAC_DOEXCF_TRACED  Only do exception if being
+ *                                                 ptrace()'ed.
+ *
+ *
+ * Returns:     0              Success
+ *              !0             Not successful
+ */

 int
 int

-mac_policy_unregister(mac_policy_handle_t handle __unused)
+mac_do_machexc(int64_t code, int64_t subcode, uint32_t flags)

 {
 {

+       mach_exception_data_type_t  codes[EXCEPTION_CODE_MAX];
+       proc_t p = current_proc();

 
 

-       return (0);
-}
+       /* Only allow execption codes in MACF's reserved range. */
+       if ((code < EXC_MACF_MIN) || (code > EXC_MACF_MAX)) {
+               return 1;
+       }

 
 

-int
-mac_audit_text(char *text __unused, mac_policy_handle_t handle __unused)
-{
+       if (flags & MAC_DOEXCF_TRACED &&
+           !(p->p_lflag & P_LTRACED && (p->p_lflag & P_LPPWAIT) == 0)) {
+               return 0;
+       }

 
 

-       return (0);
-}

 
 

-int
-mac_mount_label_get(struct mount *mp __unused, user_addr_t mac_p __unused)
-{
-       return (ENOSYS);
-}
+       /* Send the Mach exception */
+       codes[0] = (mach_exception_data_type_t)code;
+       codes[1] = (mach_exception_data_type_t)subcode;

 
 

-int
-mac_vnop_setxattr(struct vnode *vp __unused, const char *name __unused, char *buf __unused, size_t len __unused)
-{
-
-       return (ENOENT);
+       return bsd_exception(EXC_SOFTWARE, codes, 2) != KERN_SUCCESS;

 }
 
 }
 

-int
-mac_vnop_getxattr(struct vnode *vp __unused, const char *name __unused, 
-       char *buf __unused, size_t len __unused, size_t *attrlen __unused)
-{
+#else /* MAC */

 
 

-       return (ENOENT);
-}
+void (*load_security_extensions_function)(void) = 0;

 
 

-int
-mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)
-{
-
-       return (ENOENT);
-}
+struct sysctl_oid_list sysctl__security_mac_children;

 
 int
 
 int

-__mac_get_pid(proc_t p __unused, struct __mac_get_pid_args *uap __unused, register_t *ret __unused)
+mac_policy_register(struct mac_policy_conf *mpc __unused,
+    mac_policy_handle_t *handlep __unused, void *xd __unused)

 {
 {

-
-       return (ENOSYS);
+       return 0;

 }
 
 int
 }
 
 int

-__mac_get_proc(proc_t p __unused, struct __mac_get_proc_args *uap __unused, register_t *ret __unused)
+mac_policy_unregister(mac_policy_handle_t handle __unused)

 {
 {

-
-       return (ENOSYS);
+       return 0;

 }
 
 int
 }
 
 int

-__mac_set_proc(proc_t p __unused, struct __mac_set_proc_args *uap __unused, register_t *ret __unused)
+mac_audit_text(char *text __unused, mac_policy_handle_t handle __unused)

 {
 {

-
-       return (ENOSYS);
+       return 0;

 }
 
 int
 }
 
 int

-__mac_get_file(proc_t p __unused, struct __mac_get_file_args *uap __unused, register_t *ret __unused)
+mac_vnop_setxattr(struct vnode *vp __unused, const char *name __unused, char *buf __unused, size_t len __unused)

 {
 {

-
-       return (ENOSYS);
+       return ENOENT;

 }
 
 int
 }
 
 int

-__mac_get_link(proc_t p __unused, struct __mac_get_link_args *uap __unused, register_t *ret __unused)
+mac_vnop_getxattr(struct vnode *vp __unused, const char *name __unused,
+    char *buf __unused, size_t len __unused, size_t *attrlen __unused)

 {
 {

-
-       return (ENOSYS);
+       return ENOENT;

 }
 
 int
 }
 
 int

-__mac_set_file(proc_t p __unused, struct __mac_set_file_args *uap __unused, register_t *ret __unused)
+mac_vnop_removexattr(struct vnode *vp __unused, const char *name __unused)

 {
 {

-
-       return (ENOSYS);
+       return ENOENT;

 }
 
 int
 }
 
 int

-__mac_set_link(proc_t p __unused, struct __mac_set_link_args *uap __unused, register_t *ret __unused)
+mac_file_setxattr(struct fileglob *fg __unused, const char *name __unused, char *buf __unused, size_t len __unused)

 {
 {

-
-       return (ENOSYS);
+       return ENOENT;

 }
 
 int
 }
 
 int

-__mac_get_fd(proc_t p __unused, struct __mac_get_fd_args *uap __unused, register_t *ret __unused)
+mac_file_getxattr(struct fileglob *fg __unused, const char *name __unused,
+    char *buf __unused, size_t len __unused, size_t *attrlen __unused)

 {
 {

-
-       return (ENOSYS);
+       return ENOENT;

 }
 
 int
 }
 
 int

-__mac_set_fd(proc_t p __unused, struct __mac_set_fd_args *uap __unused, register_t *ret __unused)
+mac_file_removexattr(struct fileglob *fg __unused, const char *name __unused)

 {
 {

-
-       return (ENOSYS);
+       return ENOENT;

 }
 
 }
 

-int
-__mac_syscall(proc_t p __unused, struct __mac_syscall_args *uap __unused, register_t *ret __unused)
+intptr_t
+mac_label_get(struct label *l __unused, int slot __unused)

 {
 {

-
-       return (ENOSYS);
+       return 0;

 }
 
 }
 

-int
-__mac_get_lcid(proc_t p __unused, struct __mac_get_lcid_args *uap __unused, register_t *ret __unused)
+void
+mac_label_set(struct label *l __unused, int slot __unused, intptr_t v __unused)

 {
 {

-
-       return (ENOSYS);
+       return;

 }
 
 }
 

+int mac_iokit_check_hid_control(kauth_cred_t cred __unused);

 int
 int

-__mac_get_lctx(proc_t p __unused, struct __mac_get_lctx_args *uap __unused, register_t *ret __unused)
+mac_iokit_check_hid_control(kauth_cred_t cred __unused)

 {
 {

-
-       return (ENOSYS);
+       return 0;

 }
 
 }
 

+int mac_mount_check_snapshot_mount(vfs_context_t ctx, struct vnode *rvp, struct vnode *vp, struct componentname *cnp,
+    const char *name, const char *vfc_name);

 int
 int

-__mac_set_lctx(proc_t p __unused, struct __mac_set_lctx_args *uap __unused, register_t *ret __unused)
+mac_mount_check_snapshot_mount(vfs_context_t ctx __unused, struct vnode *rvp __unused, struct vnode *vp __unused,
+    struct componentname *cnp __unused, const char *name __unused, const char *vfc_name __unused)

 {
 {

-
-       return (ENOSYS);
+       return 0;

 }
 
 }
 

+int mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused);

 int
 int

-__mac_get_mount(proc_t p __unused,
-    struct __mac_get_mount_args *uap __unused, register_t *ret __unused)
+mac_vnode_check_trigger_resolve(vfs_context_t ctx __unused, struct vnode *dvp __unused, struct componentname *cnp __unused)

 {
 {

-
-       return (ENOSYS);
+       return 0;

 }
 }

+

 #endif /* !MAC */
 #endif /* !MAC */