Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.h

begun with a repo-copy of mac.h to mac_framework.h.  sys/mac.h now
contains the userspace and user<->kernel API and definitions, with all
in-kernel interfaces moved to mac_framework.h, which is now included
across most of the kernel instead.

This change is the first step in a larger cleanup and sweep of MAC
Framework interfaces in the kernel, and will not be MFC'd.

Obtained from:	TrustedBSD Project
Sponsored by:	SPARTA

sys/compat/linux/linux_file.c

@@ -40,7 +40,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/file.h>
 #include <sys/filedesc.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -52,6 +51,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/unistd.h>
 #include <sys/vnode.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <ufs/ufs/extattr.h>
 #include <ufs/ufs/quota.h>
 #include <ufs/ufs/ufsmount.h>

sys/compat/linux/linux_getcwd.c

@@ -54,7 +54,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/mount.h>
 #include <sys/proc.h>
 #include <sys/uio.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/dirent.h>
 #include <ufs/ufs/dir.h>	/* XXX only for DIRBLKSIZ */
@@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$");
 #endif
 #include <compat/linux/linux_util.h>
 
+#include <security/mac/mac_framework.h>
+
 static int
 linux_getcwd_scandir(struct vnode **, struct vnode **,
     char **, char *, struct thread *);

sys/compat/linux/linux_misc.c

@@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mman.h>
 #include <sys/mount.h>
@@ -63,6 +62,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/vnode.h>
 #include <sys/wait.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/pmap.h>
 #include <vm/vm_kern.h>

sys/compat/linux/linux_stats.c

@@ -38,7 +38,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/filedesc.h>
 #include <sys/proc.h>
 #include <sys/jail.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/namei.h>
@@ -59,6 +58,8 @@ __FBSDID("$FreeBSD$");
 
 #include <compat/linux/linux_util.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * XXX: This was removed from newstat_copyout(), and almost identical
  * XXX: code was in stat64_copyout().  findcdev() needs to be replaced

sys/compat/svr4/svr4_fcntl.c

@@ -40,7 +40,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/filedesc.h>
 /*#include <sys/ioctl.h>*/
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -60,6 +59,8 @@ __FBSDID("$FreeBSD$");
 #include <compat/svr4/svr4_util.h>
 #include <compat/svr4/svr4_fcntl.h>
 
+#include <security/mac/mac_framework.h>
+
 static int svr4_to_bsd_flags(int);
 static u_long svr4_to_bsd_cmd(u_long);
 static int fd_revoke(struct thread *, int);

sys/compat/svr4/svr4_misc.c

@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/imgact.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/file.h>		/* Must come after sys/malloc.h */
 #include <sys/mman.h>
@@ -83,6 +82,8 @@ __FBSDID("$FreeBSD$");
 #include <compat/svr4/svr4_mman.h>
 #include <compat/svr4/svr4_wait.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <machine/vmparam.h>
 #include <vm/vm.h>
 #include <vm/vm_param.h>

sys/contrib/pf/net/pf.c

@@ -79,7 +79,6 @@
 #include <sys/kernel.h>
 #include <sys/time.h>
 #ifdef __FreeBSD__
-#include <sys/mac.h>
 #include <sys/sysctl.h>
 #include <sys/endian.h>
 #else
@@ -132,6 +131,7 @@
 #include <machine/in_cksum.h>
 #include <sys/limits.h>
 #include <sys/ucred.h>
+#include <security/mac/mac_framework.h>
 
 extern int ip_optcopy(struct ip *, struct ip *);
 #endif

sys/fs/devfs/devfs_devs.c

@@ -37,7 +37,6 @@
 #include <sys/kernel.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/proc.h>
 #include <sys/sx.h>
@@ -49,6 +48,8 @@
 #include <fs/devfs/devfs.h>
 #include <fs/devfs/devfs_int.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * The one true (but secret) list of active devices in the system.
  * Locked by dev_lock()/devmtx

sys/fs/devfs/devfs_vnops.c

@@ -52,7 +52,6 @@
 #include <sys/filio.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/namei.h>
@@ -71,6 +70,8 @@ static struct fileops devfs_ops_f;
 #include <fs/devfs/devfs.h>
 #include <fs/devfs/devfs_int.h>
 
+#include <security/mac/mac_framework.h>
+
 struct mtx	devfs_de_interlock;
 MTX_SYSINIT(devfs_de_interlock, &devfs_de_interlock, "devfs interlock", MTX_DEF);
 

sys/i386/i386/sys_machdep.c

@@ -38,7 +38,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/proc.h>
@@ -57,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/sysarch.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm_kern.h>		/* for kernel_map */
 

sys/i386/ibcs2/ibcs2_misc.c

@@ -65,7 +65,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/imgact.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/file.h>			/* Must come after sys/malloc.h */
 #include <sys/mutex.h>
@@ -90,6 +89,8 @@ __FBSDID("$FreeBSD$");
 #include <i386/ibcs2/ibcs2_utime.h>
 #include <i386/ibcs2/ibcs2_xenix.h>
 
+#include <security/mac/mac_framework.h>
+
 int
 ibcs2_ulimit(td, uap)
 	struct thread *td;

sys/kern/init_main.c

@@ -55,7 +55,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/filedesc.h>
 #include <sys/ktr.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/syscallsubr.h>
@@ -78,6 +77,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/cpu.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_param.h>

sys/kern/kern_acct.c

@@ -53,7 +53,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/kthread.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
@@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/tty.h>
 #include <sys/vnode.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * The routines implemented in this file are described in:
  *      Leffler, et al.: The Design and Implementation of the 4.3BSD

sys/kern/kern_acl.c

@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
@@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/acl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 uma_zone_t	acl_zone;

sys/kern/kern_alq.c

@@ -34,7 +34,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/kthread.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
@@ -46,6 +45,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/fcntl.h>
 #include <sys/eventhandler.h>
 
+#include <security/mac/mac_framework.h>
+
 /* Async. Logging Queue */
 struct alq {
 	int	aq_entmax;		/* Max entries */

sys/kern/kern_environment.c

@@ -44,7 +44,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/proc.h>
 #include <sys/queue.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/kernel.h>
@@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/libkern.h>
 #include <sys/kenv.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_KENV, "kenv", "kernel environment");
 
 #define KENV_SIZE	512	/* Maximum number of environment strings */

sys/kern/kern_exec.c

@@ -39,7 +39,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysproto.h>
 #include <sys/signalvar.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/filedesc.h>
 #include <sys/fcntl.h>
@@ -80,6 +79,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/reg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 MALLOC_DEFINE(M_PARGS, "proc-args", "Process arguments");
 

sys/kern/kern_exit.c

@@ -65,7 +65,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/ptrace.h>
 #include <sys/acct.h>		/* for acct_process() function prototype */
 #include <sys/filedesc.h>
-#include <sys/mac.h>
 #include <sys/shm.h>
 #include <sys/sem.h>
 #ifdef KTRACE
@@ -73,6 +72,7 @@ __FBSDID("$FreeBSD$");
 #endif
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_extern.h>

sys/kern/kern_fork.c

@@ -59,7 +59,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/vmmeter.h>
 #include <sys/vnode.h>
 #include <sys/acct.h>
-#include <sys/mac.h>
 #include <sys/ktr.h>
 #include <sys/ktrace.h>
 #include <sys/unistd.h>	
@@ -67,6 +66,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/signalvar.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/pmap.h>

sys/kern/kern_jail.c

@@ -18,7 +18,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/errno.h>
 #include <sys/sysproto.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/proc.h>
 #include <sys/taskqueue.h>
@@ -35,6 +34,8 @@ __FBSDID("$FreeBSD$");
 #include <net/if.h>
 #include <netinet/in.h>
 
+#include <security/mac/mac_framework.h>
+
 MALLOC_DEFINE(M_PRISON, "prison", "Prison structures");
 
 SYSCTL_NODE(_security, OID_AUTO, jail, CTLFLAG_RW, 0,

sys/kern/kern_ktrace.c

@@ -44,7 +44,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kthread.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/namei.h>
@@ -57,6 +56,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/syslog.h>
 #include <sys/sysproto.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * The ktrace facility allows the tracing of certain key events in user space
  * processes, such as system calls, signal delivery, context switches, and

sys/kern/kern_linker.c

@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/sx.h>
-#include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/mount.h>
 #include <sys/linker.h>
@@ -52,6 +51,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/syscallsubr.h>
 #include <sys/sysctl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include "linker_if.h"
 
 #ifdef HWPMC_HOOKS

sys/kern/kern_mac.c

@@ -2,7 +2,7 @@
  * Copyright (c) 1999-2002 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
- * Copyright (c) 2005 SPARTA, Inc.
+ * Copyright (c) 2005-2006 SPARTA, Inc.
  * All rights reserved.
  *
  * This software was developed by Robert Watson and Ilmar Habibulin for the
@@ -91,6 +91,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/in.h>
 #include <netinet/ip_var.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 #ifdef MAC

sys/kern/kern_mbuf.c

@@ -32,7 +32,6 @@ __FBSDID("$FreeBSD$");
 #include "opt_param.h"
 
 #include <sys/param.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
@@ -43,6 +42,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/smp.h>
 #include <sys/sysctl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_page.h>
 #include <vm/uma.h>

sys/kern/kern_prot.c

@@ -51,7 +51,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kdb.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/refcount.h>
@@ -67,6 +66,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysctl.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 static MALLOC_DEFINE(M_CRED, "cred", "credentials");
 

sys/kern/kern_shutdown.c

@@ -53,7 +53,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kdb.h>
 #include <sys/kernel.h>
 #include <sys/kthread.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
@@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$");
 #include <machine/pcb.h>
 #include <machine/smp.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_object.h>
 #include <vm/vm_page.h>

sys/kern/kern_sysctl.c

@@ -45,13 +45,15 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/proc.h>
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/sx.h>
 #include <sys/sysproto.h>
+
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_extern.h>
 

sys/kern/kern_time.c

@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/resourcevar.h>
 #include <sys/signalvar.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/syscallsubr.h>
 #include <sys/sysctl.h>
 #include <sys/sysent.h>
@@ -57,6 +56,8 @@ __FBSDID("$FreeBSD$");
 
 #include <posix4/posix4.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_extern.h>
 

sys/kern/link_elf.c

@@ -37,7 +37,6 @@ __FBSDID("$FreeBSD$");
 #endif
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/mount.h>
@@ -49,6 +48,8 @@ __FBSDID("$FreeBSD$");
 
 #include <machine/elf.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_param.h>
 #ifdef SPARSE_MAPPING

sys/kern/link_elf_obj.c

@@ -35,7 +35,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mutex.h>
 #include <sys/mount.h>
@@ -47,6 +46,8 @@ __FBSDID("$FreeBSD$");
 
 #include <machine/elf.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_param.h>
 #include <vm/vm_object.h>

sys/kern/subr_trap.c

@@ -50,7 +50,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/bus.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/proc.h>
 #include <sys/ktr.h>
@@ -67,6 +66,8 @@ __FBSDID("$FreeBSD$");
 #include <machine/cpu.h>
 #include <machine/pcb.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * Define the code needed before returning to user mode, for
  * trap and syscall.

sys/kern/sys_pipe.c

@@ -101,7 +101,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/filio.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/ttycom.h>
 #include <sys/stat.h>
@@ -117,6 +116,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/event.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_param.h>
 #include <vm/vm_object.h>

sys/kern/sys_socket.c

@@ -38,7 +38,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/file.h>
 #include <sys/filedesc.h>
-#include <sys/mac.h>
 #include <sys/proc.h>
 #include <sys/protosw.h>
 #include <sys/sigio.h>
@@ -55,6 +54,8 @@ __FBSDID("$FreeBSD$");
 #include <net/if.h>
 #include <net/route.h>
 
+#include <security/mac/mac_framework.h>
+
 struct	fileops socketops = {
 	.fo_read = soo_read,
 	.fo_write = soo_write,

sys/kern/sysv_msg.c

@@ -59,7 +59,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/proc.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/module.h>
 #include <sys/msg.h>
@@ -70,6 +69,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/malloc.h>
 #include <sys/jail.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_MSG, "msg", "SVID compatible message queues");
 
 static void msginit(void);

sys/kern/sysv_sem.c

@@ -59,7 +59,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/malloc.h>
 #include <sys/jail.h>
-#include <sys/mac.h>
+
+#include <security/mac/mac_framework.h>
 
 static MALLOC_DEFINE(M_SEM, "sem", "SVID compatible semaphores");
 

sys/kern/sysv_shm.c

@@ -84,7 +84,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/sysproto.h>
 #include <sys/jail.h>
-#include <sys/mac.h>
+
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_param.h>

sys/kern/uipc_mbuf.c

@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kernel.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/sysctl.h>
@@ -49,6 +48,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/protosw.h>
 #include <sys/uio.h>
 
+#include <security/mac/mac_framework.h>
+
 int	max_linkhdr;
 int	max_protohdr;
 int	max_hdr;

sys/kern/uipc_mbuf2.c

@@ -71,11 +71,12 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/mutex.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_PACKET_TAGS, MBUF_TAG_MEM_NAME,
     "packet-attached information");
 

sys/kern/uipc_sem.c

@@ -54,7 +54,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/sysctl.h>
 #include <sys/time.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/fcntl.h>
 
@@ -63,6 +62,8 @@ __FBSDID("$FreeBSD$");
 #include <posix4/semaphore.h>
 #include <posix4/_semaphore.h>
 
+#include <security/mac/mac_framework.h>
+
 static int sem_count_proc(struct proc *p);
 static struct ksem *sem_lookup_byname(const char *name);
 static int sem_create(struct thread *td, const char *name,

sys/kern/uipc_socket.c

@@ -126,6 +126,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/uio.h>
 #include <sys/jail.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 #ifdef COMPAT_IA32

sys/kern/uipc_syscalls.c

@@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/sysproto.h>
 #include <sys/malloc.h>
@@ -68,6 +67,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/ktrace.h>
 #endif
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_object.h>
 #include <vm/vm_page.h>

sys/kern/uipc_usrreq.c

@@ -64,7 +64,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -84,6 +83,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/unpcb.h>
 #include <sys/vnode.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 static uma_zone_t unp_zone;

sys/kern/vfs_acl.c

@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/vnode.h>
@@ -54,6 +53,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysent.h>
 #include <sys/acl.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/uma.h>
 
 uma_zone_t	acl_zone;

sys/kern/vfs_extattr.c

@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/bio.h>
 #include <sys/buf.h>
 #include <sys/sysent.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -71,6 +70,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/stdarg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_object.h>

sys/kern/vfs_lookup.c

@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
 #include <sys/vnode.h>
@@ -59,6 +58,7 @@ __FBSDID("$FreeBSD$");
 #endif
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/uma.h>
 

sys/kern/vfs_mount.c

@@ -43,7 +43,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/libkern.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -65,6 +64,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/stdarg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include "opt_rootdevname.h"
 #include "opt_ddb.h"

sys/kern/vfs_subr.c

@@ -58,7 +58,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/kdb.h>
 #include <sys/kernel.h>
 #include <sys/kthread.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/namei.h>
@@ -72,6 +71,8 @@ __FBSDID("$FreeBSD$");
 
 #include <machine/stdarg.h>
 
+#include <security/mac/mac_framework.h>
+
 #include <vm/vm.h>
 #include <vm/vm_object.h>
 #include <vm/vm_extern.h>

sys/kern/vfs_syscalls.c

@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/bio.h>
 #include <sys/buf.h>
 #include <sys/sysent.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
@@ -71,6 +70,7 @@ __FBSDID("$FreeBSD$");
 #include <machine/stdarg.h>
 
 #include <security/audit/audit.h>
+#include <security/mac/mac_framework.h>
 
 #include <vm/vm.h>
 #include <vm/vm_object.h>

sys/kern/vfs_vnops.c

@@ -48,7 +48,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/proc.h>
 #include <sys/limits.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mount.h>
 #include <sys/mutex.h>
 #include <sys/namei.h>
@@ -62,6 +61,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/syslog.h>
 #include <sys/unistd.h>
 
+#include <security/mac/mac_framework.h>
+
 static fo_rdwr_t	vn_read;
 static fo_rdwr_t	vn_write;
 static fo_ioctl_t	vn_ioctl;

sys/net/bpf.c

@@ -45,7 +45,6 @@
 #include <sys/systm.h>
 #include <sys/conf.h>
 #include <sys/fcntl.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/time.h>
@@ -77,6 +76,8 @@
 
 #include <net80211/ieee80211_freebsd.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_BPF, "BPF", "BPF data");
 
 #if defined(DEV_BPF) || defined(NETGRAPH_BPF)

sys/net/bsd_comp.c

@@ -45,7 +45,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/mutex.h>
@@ -55,6 +54,8 @@
 #define PACKETPTR	struct mbuf *
 #include <net/ppp_comp.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * PPP "BSD compress" compression
  *  The differences between this compression and the classic BSD LZW

sys/net/if.c

@@ -39,7 +39,6 @@
 #include <sys/param.h>
 #include <sys/types.h>
 #include <sys/conf.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/sbuf.h>
 #include <sys/bus.h>
@@ -82,6 +81,8 @@
 #include <netinet/ip_carp.h>
 #endif
 
+#include <security/mac/mac_framework.h>
+
 SYSCTL_NODE(_net, PF_LINK, link, CTLFLAG_RW, 0, "Link layers");
 SYSCTL_NODE(_net_link, 0, generic, CTLFLAG_RW, 0, "Generic link-management");
 

sys/net/if_atmsubr.c

@@ -46,7 +46,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/module.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/sockio.h>
@@ -71,6 +70,8 @@ __FBSDID("$FreeBSD$");
 #include <netnatm/natm.h>
 #endif
 
+#include <security/mac/mac_framework.h>
+
 /*
  * Netgraph interface functions.
  * These need not be protected by a lock, because ng_atm nodes are persitent.

sys/net/if_ethersubr.c

@@ -41,7 +41,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/module.h>
 #include <sys/mbuf.h>
@@ -97,6 +96,8 @@ extern u_char	at_org_code[3];
 extern u_char	aarp_org_code[3];
 #endif /* NETATALK */
 
+#include <security/mac/mac_framework.h>
+
 /* netgraph node hooks for ng_ether(4) */
 void	(*ng_ether_input_p)(struct ifnet *ifp, struct mbuf **mp);
 void	(*ng_ether_input_orphan_p)(struct ifnet *ifp, struct mbuf *m);

sys/net/if_fddisubr.c

@@ -45,7 +45,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
@@ -89,6 +88,8 @@ extern u_char	at_org_code[ 3 ];
 extern u_char	aarp_org_code[ 3 ];
 #endif /* NETATALK */
 
+#include <security/mac/mac_framework.h>
+
 static const u_char fddibroadcastaddr[FDDI_ADDR_LEN] =
 			{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 

sys/net/if_fwsubr.c

@@ -37,7 +37,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
@@ -62,6 +61,8 @@
 #include <netinet6/nd6.h>
 #endif
 
+#include <security/mac/mac_framework.h>
+
 MALLOC_DEFINE(M_FWCOM, "fw_com", "firewire interface internals");
 
 struct fw_hwaddr firewire_broadcastaddr = {

sys/net/if_gif.c

@@ -37,7 +37,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
@@ -84,6 +83,8 @@
 #include <net/if_bridgevar.h>
 #include <net/if_gif.h>
 
+#include <security/mac/mac_framework.h>
+
 #define GIFNAME		"gif"
 
 /*

sys/net/if_iso88025subr.c

@@ -48,7 +48,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
@@ -79,6 +78,8 @@
 #include <netipx/ipx_if.h>
 #endif
 
+#include <security/mac/mac_framework.h>
+
 static const u_char iso88025_broadcastaddr[ISO88025_ADDR_LEN] =
 			{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 

sys/net/if_ppp.c

@@ -88,7 +88,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/proc.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/filio.h>
@@ -123,6 +122,8 @@
 #include <net/if_ppp.h>
 #include <net/if_pppvar.h>
 
+#include <security/mac/mac_framework.h>
+
 /* minimise diffs */
 #ifndef splsoftnet
 #define splsoftnet	splnet

sys/net/if_stf.c

@@ -82,7 +82,6 @@
 #include <sys/systm.h>
 #include <sys/socket.h>
 #include <sys/sockio.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/errno.h>
 #include <sys/kernel.h>
@@ -117,6 +116,8 @@
 
 #include <net/bpf.h>
 
+#include <security/mac/mac_framework.h>
+
 #define STFNAME		"stf"
 #define STFUNIT		0
 

sys/net/if_tun.c

@@ -25,7 +25,6 @@
 #include <sys/param.h>
 #include <sys/proc.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
 #include <sys/socket.h>
@@ -56,6 +55,8 @@
 
 #include <sys/queue.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * tun_list is protected by global tunmtx.  Other mutable fields are
  * protected by tun->tun_mtx, or by their owning subsystem.  tun_dev is

sys/netatalk/aarp.c

@@ -56,7 +56,6 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/kernel.h>
 #include <sys/socket.h>
@@ -75,6 +74,8 @@
 #include <netatalk/phase2.h>
 #include <netatalk/at_extern.h>
 
+#include <security/mac/mac_framework.h>
+
 static void aarptfree(struct aarptab *aat);
 static void at_aarpinput(struct ifnet *ifp, struct mbuf *m);
 

sys/netatalk/ddp_input.c

@@ -55,7 +55,6 @@
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/signalvar.h>
 #include <sys/socket.h>
@@ -72,6 +71,8 @@
 #include <netatalk/ddp_pcb.h>
 #include <netatalk/at_extern.h>
 
+#include <security/mac/mac_framework.h>
+
 static volatile int	ddp_forward = 1;
 static volatile int	ddp_firewall = 0;
 static struct ddpstat	ddpstat;

sys/netatalk/ddp_output.c

@@ -27,7 +27,6 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
@@ -43,6 +42,8 @@
 #include <netatalk/ddp_var.h>
 #include <netatalk/at_extern.h>
 
+#include <security/mac/mac_framework.h>
+
 int	ddp_cksum = 1;
 
 int

sys/netinet/if_ether.c

@@ -45,7 +45,6 @@
 #include <sys/queue.h>
 #include <sys/sysctl.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/malloc.h>
 #include <sys/socket.h>
@@ -70,6 +69,8 @@
 #include <netinet/ip_carp.h>
 #endif
 
+#include <security/mac/mac_framework.h>
+
 #define SIN(s) ((struct sockaddr_in *)s)
 #define SDL(s) ((struct sockaddr_dl *)s)
 

sys/netinet/igmp.c

@@ -49,7 +49,6 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
@@ -71,6 +70,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_IGMP, "igmp", "igmp state");
 
 static struct router_info	*find_rti(struct ifnet *ifp);

sys/netinet/in_pcb.c

@@ -36,7 +36,6 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/domain.h>
@@ -80,6 +79,8 @@
 #include <netipsec/key.h>
 #endif /* FAST_IPSEC */
 
+#include <security/mac/mac_framework.h>
+
 /*
  * These configure the range of local port addresses assigned to
  * "unspecified" outgoing connections/packets/whatever.

sys/netinet/ip_divert.c

@@ -45,7 +45,6 @@
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
 #include <sys/kernel.h>
@@ -72,6 +71,8 @@
 #include <netinet/ip_var.h>
 #include <netinet/ip_fw.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * Divert sockets
  */

sys/netinet/ip_fw2.c

@@ -52,7 +52,6 @@
 #include <sys/kernel.h>
 #include <sys/lock.h>
 #include <sys/jail.h>
-#include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
 #include <sys/rwlock.h>
@@ -101,6 +100,8 @@
 
 #include <machine/in_cksum.h>	/* XXX for in_cksum */
 
+#include <security/mac/mac_framework.h>
+
 /*
  * set_disable contains one bit per set value (0..31).
  * If the bit is set, all rules with the corresponding set

sys/netinet/ip_icmp.c

@@ -35,7 +35,6 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
@@ -73,6 +72,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * ICMP routines: error generation, receive packet processing, and
  * routines to turnaround packets back to the originator, and

sys/netinet/ip_input.c

@@ -40,7 +40,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/callout.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/malloc.h>
 #include <sys/domain.h>
@@ -81,6 +80,8 @@
 #include <netinet/ip_fw.h>
 #include <netinet/ip_dummynet.h>
 
+#include <security/mac/mac_framework.h>
+
 int rsvp_on = 0;
 
 int	ipforwarding = 0;

sys/netinet/ip_mroute.c

@@ -65,7 +65,6 @@
 #include <sys/param.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/module.h>
@@ -98,6 +97,8 @@
 #include <netinet/udp.h>
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * Control debugging code for rsvp and multicast routing code.
  * Can only set them with the debugger.

sys/netinet/ip_options.c

@@ -36,7 +36,6 @@
 
 #include <sys/param.h>
 #include <sys/systm.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 /* #include <sys/malloc.h> */
 #include <sys/domain.h>
@@ -66,6 +65,8 @@
 
 #include <sys/socketvar.h>
 
+#include <security/mac/mac_framework.h>
+
 static int	ip_dosourceroute = 0;
 SYSCTL_INT(_net_inet_ip, IPCTL_SOURCEROUTE, sourceroute, CTLFLAG_RW,
     &ip_dosourceroute, 0, "Enable forwarding source routed IP packets");

sys/netinet/ip_output.c

@@ -38,7 +38,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/protosw.h>
@@ -71,6 +70,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_IPMOPTS, "ip_moptions", "internet multicast options");
 
 #define print_ip(x, a, y)	 printf("%s %d.%d.%d.%d%s",\

sys/netinet/raw_ip.c

@@ -38,7 +38,6 @@
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/proc.h>
@@ -74,6 +73,8 @@
 #include <netinet6/ipsec.h>
 #endif /*IPSEC*/
 
+#include <security/mac/mac_framework.h>
+
 struct	inpcbhead ripcb;
 struct	inpcbinfo ripcbinfo;
 

sys/netinet/tcp_input.c

@@ -41,7 +41,6 @@
 
 #include <sys/param.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/proc.h>		/* for proc0 declaration */
@@ -98,6 +97,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 static const int tcprexmtthresh = 3;
 
 struct	tcpstat tcpstat;

sys/netinet/tcp_output.c

@@ -42,7 +42,6 @@
 #include <sys/domain.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/mutex.h>
 #include <sys/protosw.h>
@@ -85,6 +84,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 #ifdef notyet
 extern struct mbuf *m_copypack();
 #endif

sys/netinet/tcp_reass.c

@@ -41,7 +41,6 @@
 
 #include <sys/param.h>
 #include <sys/kernel.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/proc.h>		/* for proc0 declaration */
@@ -98,6 +97,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 static const int tcprexmtthresh = 3;
 
 struct	tcpstat tcpstat;

sys/netinet/tcp_subr.c

@@ -43,7 +43,6 @@
 #include <sys/callout.h>
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #ifdef INET6
@@ -113,6 +112,8 @@
 #include <machine/in_cksum.h>
 #include <sys/md5.h>
 
+#include <security/mac/mac_framework.h>
+
 int	tcp_mssdflt = TCP_MSS;
 SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW,
     &tcp_mssdflt , 0, "Default TCP Maximum Segment Size");

sys/netinet/tcp_syncache.c

@@ -44,7 +44,6 @@
 #include <sys/lock.h>
 #include <sys/mutex.h>
 #include <sys/malloc.h>
-#include <sys/mac.h>
 #include <sys/mbuf.h>
 #include <sys/md5.h>
 #include <sys/proc.h>		/* for proc0 declaration */
@@ -97,6 +96,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 static int tcp_syncookies = 1;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, syncookies, CTLFLAG_RW,
     &tcp_syncookies, 0,

sys/netinet/tcp_timewait.c

@@ -43,7 +43,6 @@
 #include <sys/callout.h>
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #ifdef INET6
@@ -113,6 +112,8 @@
 #include <machine/in_cksum.h>
 #include <sys/md5.h>
 
+#include <security/mac/mac_framework.h>
+
 int	tcp_mssdflt = TCP_MSS;
 SYSCTL_INT(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt, CTLFLAG_RW,
     &tcp_mssdflt , 0, "Default TCP Maximum Segment Size");

sys/netinet/udp_usrreq.c

@@ -42,7 +42,6 @@
 #include <sys/jail.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/proc.h>
@@ -87,6 +86,8 @@
 
 #include <machine/in_cksum.h>
 
+#include <security/mac/mac_framework.h>
+
 /*
  * UDP protocol implementation.
  * Per RFC 768, August, 1980.

sys/netinet6/nd6.c

@@ -37,7 +37,6 @@
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/callout.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
@@ -69,6 +68,8 @@
 
 #include <sys/limits.h>
 
+#include <security/mac/mac_framework.h>
+
 #define ND6_SLOWTIMER_INTERVAL (60 * 60) /* 1 hour */
 #define ND6_RECALC_REACHTM_INTERVAL (60 * 120) /* 2 hours */
 

sys/nfsserver/nfs_srvsock.c

@@ -45,7 +45,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/systm.h>
 #include <sys/kernel.h>
 #include <sys/lock.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/mount.h>
@@ -69,6 +68,8 @@ __FBSDID("$FreeBSD$");
 #include <nfs/xdr_subs.h>
 #include <nfsserver/nfsm_subs.h>
 
+#include <security/mac/mac_framework.h>
+
 #define	TRUE	1
 #define	FALSE	0
 

sys/nfsserver/nfs_syscalls.c

@@ -46,7 +46,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/file.h>
 #include <sys/filedesc.h>
 #include <sys/vnode.h>
-#include <sys/mac.h>
 #include <sys/malloc.h>
 #include <sys/mount.h>
 #include <sys/proc.h>
@@ -74,6 +73,8 @@ __FBSDID("$FreeBSD$");
 #include <nfsserver/nfsm_subs.h>
 #include <nfsserver/nfsrvcache.h>
 
+#include <security/mac/mac_framework.h>
+
 static MALLOC_DEFINE(M_NFSSVC, "nfsserver_srvsock", "Nfs server structure");
 
 MALLOC_DEFINE(M_NFSRVDESC, "nfsserver_srvdesc", "NFS server socket descriptor");

sys/security/mac/mac_framework.c

@@ -2,7 +2,7 @@
  * Copyright (c) 1999-2002 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
- * Copyright (c) 2005 SPARTA, Inc.
+ * Copyright (c) 2005-2006 SPARTA, Inc.
  * All rights reserved.
  *
  * This software was developed by Robert Watson and Ilmar Habibulin for the
@@ -91,6 +91,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/in.h>
 #include <netinet/ip_var.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 #ifdef MAC

sys/security/mac/mac_framework.h

@@ -1,7 +1,7 @@
 /*-
  * Copyright (c) 1999-2002 Robert N. M. Watson
  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
- * Copyright (c) 2005 SPARTA, Inc.
+ * Copyright (c) 2005-2006 SPARTA, Inc.
  * All rights reserved.
  *
  * This software was developed by Robert Watson for the TrustedBSD Project.
@@ -37,91 +37,33 @@
  *
  * $FreeBSD$
  */
+
 /*
- * Userland/kernel interface for Mandatory Access Control.
+ * Kernel interface for Mandatory Access Control -- how kernel services
- *
+ * interact with the TrustedBSD MAC Framework.
- * The POSIX.1e implementation page may be reached at:
- * http://www.trustedbsd.org/
  */
 
-#ifndef _SYS_MAC_H_
+#ifndef _SYS_SECURITY_MAC_MAC_FRAMEWORK_H_
-#define	_SYS_MAC_H_
+#define	_SYS_SECURITY_MAC_MAC_MAC_FRAMEWORK_H_
+
+#ifndef _KERNEL
+#error "no user-serviceable parts inside"
+#endif
 
 #include <sys/_label.h>
 
-#ifndef _POSIX_MAC
-#define	_POSIX_MAC
-#endif
-
-/*
- * MAC framework-related constants and limits.
- */
-#define	MAC_MAX_POLICY_NAME		32
-#define	MAC_MAX_LABEL_ELEMENT_NAME	32
-#define	MAC_MAX_LABEL_ELEMENT_DATA	4096
-#define	MAC_MAX_LABEL_BUF_LEN		8192
-
-struct mac {
-	size_t		 m_buflen;
-	char		*m_string;
-};
-
-typedef struct mac	*mac_t;
-
-#ifndef _KERNEL
-
-/*
- * Location of the userland MAC framework configuration file.  mac.conf
- * binds policy names to shared libraries that understand those policies,
- * as well as setting defaults for MAC-aware applications.
- */
-#define	MAC_CONFFILE	"/etc/mac.conf"
-
-/*
- * Extended non-POSIX.1e interfaces that offer additional services
- * available from the userland and kernel MAC frameworks.
- */
-__BEGIN_DECLS
-int	 mac_execve(char *fname, char **argv, char **envv, mac_t _label);
-int	 mac_free(mac_t _label);
-int	 mac_from_text(mac_t *_label, const char *_text);
-int	 mac_get_fd(int _fd, mac_t _label);
-int	 mac_get_file(const char *_path, mac_t _label);
-int	 mac_get_link(const char *_path, mac_t _label);
-int	 mac_get_peer(int _fd, mac_t _label);
-int	 mac_get_pid(pid_t _pid, mac_t _label);
-int	 mac_get_proc(mac_t _label);
-int	 mac_is_present(const char *_policyname);
-int	 mac_prepare(mac_t *_label, const char *_elements);
-int	 mac_prepare_file_label(mac_t *_label);
-int	 mac_prepare_ifnet_label(mac_t *_label);
-int	 mac_prepare_process_label(mac_t *_label);
-int	 mac_prepare_type(mac_t *_label, const char *_type);
-int	 mac_set_fd(int _fildes, const mac_t _label);
-int	 mac_set_file(const char *_path, mac_t _label);
-int	 mac_set_link(const char *_path, mac_t _label);
-int	 mac_set_proc(const mac_t _label);
-int	 mac_syscall(const char *_policyname, int _call, void *_arg);
-int	 mac_to_text(mac_t mac, char **_text);
-__END_DECLS
-
-#else /* _KERNEL */
-
-/*
- * Kernel functions to manage and evaluate labels.
- */
 struct bpf_d;
 struct cdev;
 struct componentname;
 struct devfs_dirent;
 struct ifnet;
 struct ifreq;
-struct inpcb;
 struct image_params;
 struct inpcb;
 struct ipq;
 struct ksem;
 struct m_tag;
+struct mac;
 struct mbuf;
 struct mount;
 struct msg;
@@ -140,14 +82,14 @@ struct ucred;
 struct uio;
 struct vattr;
 struct vnode;
+struct vop_setlabel_args;
 
 #include <sys/acl.h>			/* XXX acl_type_t */
 
-struct vop_setlabel_args;
-
 /*
- * Label operations.
+ * Kernel functions to manage and evaluate labels.
  */
+
 void	mac_init_bpfdesc(struct bpf_d *);
 void	mac_init_cred(struct ucred *);
 void	mac_init_devfsdirent(struct devfs_dirent *);
@@ -472,6 +414,4 @@ void	mac_associate_nfsd_label(struct ucred *cred);
  */
 int	vop_stdsetlabel_ea(struct vop_setlabel_args *ap);
 
-#endif /* !_KERNEL */
+#endif /* !_SYS_SECURITY_MAC_MAC_FRAMEWORK_H_ */
-
-#endif /* !_SYS_MAC_H_ */

sys/security/mac/mac_inet.c

@@ -64,6 +64,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/in_pcb.h>
 #include <netinet/ip_var.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 static struct label *

sys/security/mac/mac_label.c

@@ -41,6 +41,7 @@ __FBSDID("$FreeBSD$");
 
 #include <vm/uma.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 uma_zone_t	zone_label;

sys/security/mac/mac_net.c

@@ -61,6 +61,7 @@ __FBSDID("$FreeBSD$");
 #include <net/if.h>
 #include <net/if_var.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 /*

sys/security/mac/mac_pipe.c

@@ -49,6 +49,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/mac_policy.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 static int	mac_enforce_pipe = 1;

sys/security/mac/mac_policy.h

@@ -55,6 +55,8 @@
  * Operations are sorted first by general class of operation, then
  * alphabetically.
  */
+#include <sys/acl.h>	/* XXX acl_type_t */
+
 struct acl;
 struct bpf_d;
 struct componentname;

sys/security/mac/mac_posix_sem.c

@@ -47,6 +47,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/mac_policy.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 static int	mac_enforce_posix_sem = 1;

sys/security/mac/mac_process.c

@@ -64,6 +64,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/mac_policy.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 int	mac_enforce_process = 1;

sys/security/mac/mac_socket.c

@@ -69,6 +69,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/in_pcb.h>
 #include <netinet/ip_var.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 /*

sys/security/mac/mac_syscalls.c

@@ -2,7 +2,7 @@
  * Copyright (c) 1999-2002 Robert N. M. Watson
  * Copyright (c) 2001 Ilmar S. Habibulin
  * Copyright (c) 2001-2005 Networks Associates Technology, Inc.
- * Copyright (c) 2005 SPARTA, Inc.
+ * Copyright (c) 2005-2006 SPARTA, Inc.
  * All rights reserved.
  *
  * This software was developed by Robert Watson and Ilmar Habibulin for the
@@ -91,6 +91,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/in.h>
 #include <netinet/ip_var.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 #ifdef MAC

sys/security/mac/mac_system.c

@@ -47,6 +47,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/mac_policy.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 static int	mac_enforce_kld = 1;

sys/security/mac/mac_sysv_msg.c

@@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/mac_policy.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 static int	mac_enforce_sysv_msg = 1;

sys/security/mac/mac_sysv_sem.c

@@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/mac_policy.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 static int	mac_enforce_sysv_sem = 1;

sys/security/mac/mac_sysv_shm.c

@@ -51,6 +51,7 @@ __FBSDID("$FreeBSD$");
 
 #include <sys/mac_policy.h>
 
+#include <security/mac/mac_framework.h>
 #include <security/mac/mac_internal.h>
 
 static int	mac_enforce_sysv_shm = 1;