# SOME DESCRIPTIVE TITLE
# Copyright (C) YEAR The FreeBSD Project
# This file is distributed under the same license as the FreeBSD Documentation package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: FreeBSD Documentation VERSION\n"
"POT-Creation-Date: 2026-08-16 15:10-0300\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"

#. type: Title =
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:19
#, no-wrap
msgid "The TrustedBSD MAC Framework"
msgstr ""

#. type: Yaml Front Matter Hash Value: title
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1
#, no-wrap
msgid "Chapter 6. The TrustedBSD MAC Framework"
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:56
#, no-wrap
msgid "MAC Documentation Copyright"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:59
msgid ""
"This documentation was developed for the FreeBSD Project by Chris Costello "
"at Safeport Network Services and Network Associates Laboratories, the "
"Security Research Division of Network Associates, Inc. under DARPA/SPAWAR "
"contract N66001-01-C-8035 (\"CBOSS\"), as part of the DARPA CHATS research "
"program."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:61
msgid ""
"Redistribution and use in source (SGML DocBook) and 'compiled' forms (SGML, "
"HTML, PDF, PostScript, RTF and so forth) with or without modification, are "
"permitted provided that the following conditions are met:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:63
msgid ""
"Redistributions of source code (SGML DocBook) must retain the above "
"copyright notice, this list of conditions and the following disclaimer as "
"the first lines of this file unmodified."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:64
msgid ""
"Redistributions in compiled form (transformed to other DTDs, converted to "
"PDF, PostScript, RTF and other formats) must reproduce the above copyright "
"notice, this list of conditions and the following disclaimer in the "
"documentation and/or other materials provided with the distribution."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:69
msgid ""
"THIS DOCUMENTATION IS PROVIDED BY THE NETWORKS ASSOCIATES TECHNOLOGY, INC "
"\"AS IS\" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED "
"TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR "
"PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NETWORKS ASSOCIATES TECHNOLOGY, "
"INC BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR "
"CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF "
"SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS "
"INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN "
"CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) "
"ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, EVEN IF ADVISED OF "
"THE POSSIBILITY OF SUCH DAMAGE."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:72
#, no-wrap
msgid "Synopsis"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:77
msgid ""
"FreeBSD includes experimental support for several mandatory access control "
"policies, as well as a framework for kernel security extensibility, the "
"TrustedBSD MAC Framework.  The MAC Framework is a pluggable access control "
"framework, permitting new security policies to be easily linked into the "
"kernel, loaded at boot, or loaded dynamically at run-time.  The framework "
"provides a variety of features to make it easier to implement new security "
"policies, including the ability to easily tag security labels (such as "
"confidentiality information) onto system objects."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:79
msgid ""
"This chapter introduces the MAC policy framework and provides documentation "
"for a sample MAC policy module."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:81
#, no-wrap
msgid "Introduction"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:87
msgid ""
"The TrustedBSD MAC framework provides a mechanism to allow the compile-time "
"or run-time extension of the kernel access control model.  New system "
"policies may be implemented as kernel modules and linked to the kernel; if "
"multiple policy modules are present, their results will be composed.  The "
"MAC Framework provides a variety of access control infrastructure services "
"to assist policy writers, including support for transient and persistent "
"policy-agnostic object security labels.  This support is currently "
"considered experimental."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:89
msgid ""
"This chapter provides information appropriate for developers of policy "
"modules, as well as potential consumers of MAC-enabled environments, to "
"learn about how the MAC Framework supports access control extension of the "
"kernel."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:91
#, no-wrap
msgid "Policy Background"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:98
msgid ""
"Mandatory Access Control (MAC), refers to a set of access control policies "
"that are mandatorily enforced on users by the operating system.  MAC "
"policies may be contrasted with Discretionary Access Control (DAC) "
"protections, by which non-administrative users may (at their discretion) "
"protect objects.  In traditional UNIX systems, DAC protections include file "
"permissions and access control lists; MAC protections include process "
"controls preventing inter-user debugging and firewalls.  A variety of MAC "
"policies have been formulated by operating system designers and security "
"researches, including the Multi-Level Security (MLS) confidentiality policy, "
"the Biba integrity policy, Role-Based Access Control (RBAC), Domain and Type "
"Enforcement (DTE), and Type Enforcement (TE).  Each model bases decisions on "
"a variety of factors, including user identity, role, and security clearance, "
"as well as security labels on objects representing concepts such as data "
"sensitivity and integrity."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:101
msgid ""
"The TrustedBSD MAC Framework is capable of supporting policy modules that "
"implement all of these policies, as well as a broad class of system "
"hardening policies, which may use existing security attributes, such as user "
"and group IDs, as well as extended attributes on files, and other system "
"properties.  In addition, despite the name, the MAC Framework can also be "
"used to implement purely discretionary policies, as policy modules are given "
"substantial flexibility in how they authorize protections."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:103
#, no-wrap
msgid "MAC Framework Kernel Architecture"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:107
msgid ""
"The TrustedBSD MAC Framework permits kernel modules to extend the operating "
"system security policy, as well as providing infrastructure functionality "
"required by many access control modules.  If multiple policies are "
"simultaneously loaded, the MAC Framework will usefully (for some definition "
"of useful) compose the results of the policies."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:109
#, no-wrap
msgid "Kernel Elements"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:112
msgid "The MAC Framework contains a number of kernel elements:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:114
msgid "Framework management interfaces"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:115
msgid "Concurrency and synchronization primitives."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:116
msgid "Policy registration"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:117
msgid "Extensible security label for kernel objects"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:118
msgid "Policy entry point composition operators"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:119
msgid "Label management primitives"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:120
msgid "Entry point API invoked by kernel services"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:121
msgid "Entry point API to policy modules"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:122
msgid ""
"Entry points implementations (policy life cycle, object life cycle/label "
"management, access control checks)."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:123
msgid "Policy-agnostic label-management system calls"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:124
msgid "`mac_syscall()` multiplex system call"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:125
msgid "Various security policies implemented as MAC policy modules"
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:127
#, no-wrap
msgid "Framework Management Interfaces"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:130
msgid ""
"The TrustedBSD MAC Framework may be directly managed using sysctl's, loader "
"tunables, and system calls."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:135
msgid ""
"In most cases, sysctl's and loader tunables of the same name modify the same "
"parameters, and control behavior such as enforcement of protections relating "
"to various kernel subsystems.  In addition, if MAC debugging support is "
"compiled into the kernel, several counters will be maintained tracking label "
"allocation.  It is generally advisable that per-subsystem enforcement "
"controls not be used to control policy behavior in production environments, "
"as they broadly impact the operation of all active policies.  Instead, per-"
"policy controls should be preferred, as they provide greater granularity and "
"greater operational consistency for policy modules."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:137
msgid ""
"Loading and unloading of policy modules is performed using the system module "
"management system calls and other system interfaces, including boot loader "
"variables; policy modules will have the opportunity to influence load and "
"unload events, including preventing undesired unloading of the policy."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:139
#, no-wrap
msgid "Policy List Concurrency and Synchronization"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:146
msgid ""
"As the set of active policies may change at run-time, and the invocation of "
"entry points is non-atomic, synchronization is required to prevent loading "
"or unloading of policies while an entry point invocation is in progress, "
"freezing the set of active policies for the duration.  This is accomplished "
"by means of a framework busy count: whenever an entry point is entered, the "
"busy count is incremented; whenever it is exited, the busy count is "
"decremented.  While the busy count is elevated, policy list changes are not "
"permitted, and threads attempting to modify the policy list will sleep until "
"the list is not busy.  The busy count is protected by a mutex, and a "
"condition variable is used to wake up sleepers waiting on policy list "
"modifications.  One side effect of this synchronization model is that "
"recursion into the MAC Framework from within a policy module is permitted, "
"although not generally used."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:149
msgid ""
"Various optimizations are used to reduce the overhead of the busy count, "
"including avoiding the full cost of incrementing and decrementing if the "
"list is empty or contains only static entries (policies that are loaded "
"before the system starts, and cannot be unloaded).  A compile-time option is "
"also provided which prevents any change in the set of loaded policies at run-"
"time, which eliminates the mutex locking costs associated with supporting "
"dynamically loaded and unloaded policies as synchronization is no longer "
"required."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:151
msgid ""
"As the MAC Framework is not permitted to block in some entry points, a "
"normal sleep lock cannot be used; as a result, it is possible for the load "
"or unload attempt to block for a substantial period of time waiting for the "
"framework to become idle."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:153
#, no-wrap
msgid "Label Synchronization"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:160
msgid ""
"As kernel objects of interest may generally be accessed from more than one "
"thread at a time, and simultaneous entry of more than one thread into the "
"MAC Framework is permitted, security attribute storage maintained by the MAC "
"Framework is carefully synchronized.  In general, existing kernel "
"synchronization on kernel object data is used to protect MAC Framework "
"security labels on the object: for example, MAC labels on sockets are "
"protected using the existing socket mutex.  Likewise, semantics for "
"concurrent access are generally identical to those of the container objects: "
"for credentials, copy-on-write semantics are maintained for label contents "
"as with the remainder of the credential structure.  The MAC Framework "
"asserts necessary locks on objects when invoked with an object reference.  "
"Policy authors must be aware of these synchronization semantics, as they "
"will sometimes limit the types of accesses permitted on labels: for example, "
"when a read-only reference to a credential is passed to a policy via an "
"entry point, only read operations are permitted on the label state attached "
"to the credential."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:162
#, no-wrap
msgid "Policy Synchronization and Concurrency"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:168
msgid ""
"Policy modules must be written to assume that many kernel threads may "
"simultaneously enter one more policy entry points due to the parallel and "
"preemptive nature of the FreeBSD kernel.  If the policy module makes use of "
"mutable state, this may require the use of synchronization primitives within "
"the policy to prevent inconsistent views on that state resulting in "
"incorrect operation of the policy.  Policies will generally be able to make "
"use of existing FreeBSD synchronization primitives for this purpose, "
"including mutexes, sleep locks, condition variables, and counting "
"semaphores.  However, policies should be written to employ these primitives "
"carefully, respecting existing kernel lock orders, and recognizing that some "
"entry points are not permitted to sleep, limiting the use of primitives in "
"those entry points to mutexes and wakeup operations."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:171
msgid ""
"When policy modules call out to other kernel subsystems, they will generally "
"need to release any in-policy locks in order to avoid violating the kernel "
"lock order or risking lock recursion.  This will maintain policy locks as "
"leaf locks in the global lock order, helping to avoid deadlock."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:173
#, no-wrap
msgid "Policy Registration"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:180
msgid ""
"The MAC Framework maintains two lists of active policies: a static list, and "
"a dynamic list.  The lists differ only with regards to their locking "
"semantics: an elevated reference count is not required to make use of the "
"static list.  When kernel modules containing MAC Framework policies are "
"loaded, the policy module will use `SYSINIT` to invoke a registration "
"function; when a policy module is unloaded, `SYSINIT` will likewise invoke a "
"de-registration function.  Registration may fail if a policy module is "
"loaded more than once, if insufficient resources are available for the "
"registration (for example, the policy might require labeling and "
"insufficient labeling state might be available), or other policy "
"prerequisites might not be met (some policies may only be loaded prior to "
"boot).  Likewise, de-registration may fail if a policy is flagged as not "
"unloadable."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:182
#, no-wrap
msgid "Entry Points"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:189
msgid ""
"Kernel services interact with the MAC Framework in two ways: they invoke a "
"series of APIs to notify the framework of relevant events, and they provide "
"a policy-agnostic label structure pointer in security-relevant objects.  The "
"label pointer is maintained by the MAC Framework via label management entry "
"points, and permits the Framework to offer a labeling service to policy "
"modules through relatively non-invasive changes to the kernel subsystem "
"maintaining the object.  For example, label pointers have been added to "
"processes, process credentials, sockets, pipes, vnodes, Mbufs, network "
"interfaces, IP reassembly queues, and a variety of other security-relevant "
"structures.  Kernel services also invoke the MAC Framework when they perform "
"important security decisions, permitting policy modules to augment those "
"decisions based on their own criteria (possibly including data stored in "
"security labels).  Most of these security critical decisions will be "
"explicit access control checks; however, some affect more general decision "
"functions such as packet matching for sockets and label transition at "
"program execution."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:191
#, no-wrap
msgid "Policy Composition"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:199
msgid ""
"When more than one policy module is loaded into the kernel at a time, the "
"results of the policy modules will be composed by the framework using a "
"composition operator.  This operator is currently hard-coded, and requires "
"that all active policies must approve a request for it to return success.  "
"As policies may return a variety of error conditions (success, access "
"denied, object does not exist, ...), a precedence operator selects the "
"resulting error from the set of errors returned by policies.  In general, "
"errors indicating that an object does not exist will be preferred to errors "
"indicating that access to an object is denied.  While it is not guaranteed "
"that the resulting composition will be useful or secure, we have found that "
"it is for many useful selections of policies.  For example, traditional "
"trusted systems often ship with two or more policies using a similar "
"composition."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:201
#, no-wrap
msgid "Labeling Support"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:207
msgid ""
"As many interesting access control extensions rely on security labels on "
"objects, the MAC Framework provides a set of policy-agnostic label "
"management system calls covering a variety of user-exposed objects.  Common "
"label types include partition identifiers, sensitivity labels, integrity "
"labels, compartments, domains, roles, and types.  By policy agnostic, we "
"mean that policy modules are able to completely define the semantics of meta-"
"data associated with an object.  Policy modules participate in the "
"internalization and externalization of string-based labels provides by user "
"applications, and can expose multiple label elements to applications if "
"desired."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:215
msgid ""
"In-memory labels are stored in slab-allocated `struct label`, which consists "
"of a fixed-length array of unions, each holding a `void *` pointer and a "
"`long`.  Policies registering for label storage will be assigned a \"slot\" "
"identifier, which may be used to dereference the label storage.  The "
"semantics of the storage are left entirely up to the policy module: modules "
"are provided with a variety of entry points associated with the kernel "
"object life cycle, including initialization, association/creation, and "
"destruction.  Using these interfaces, it is possible to implement reference "
"counting and other storage models.  Direct access to the object structure is "
"generally not required by policy modules to retrieve a label, as the MAC "
"Framework generally passes both a pointer to the object and a direct pointer "
"to the object's label into entry points.  The primary exception to this rule "
"is the process credential, which must be manually dereferenced to access the "
"credential label.  This may change in future revisions of the MAC Framework."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:222
msgid ""
"Initialization entry points frequently include a sleeping disposition flag "
"indicating whether or not an initialization is permitted to sleep; if "
"sleeping is not permitted, a failure may be returned to cancel allocation of "
"the label (and hence object).  This may occur, for example, in the network "
"stack during interrupt handling, where sleeping is not permitted, or while "
"the caller holds a mutex.  Due to the performance cost of maintaining labels "
"on in-flight network packets (Mbufs), policies must specifically declare a "
"requirement that Mbuf labels be allocated.  Dynamically loaded policies "
"making use of labels must be able to handle the case where their init "
"function has not been called on an object, as objects may already exist when "
"the policy is loaded.  The MAC Framework guarantees that uninitialized label "
"slots will hold a 0 or NULL value, which policies may use to detect "
"uninitialized values.  However, as allocation of Mbuf labels is conditional, "
"policies must also be able to handle a NULL label pointer for Mbufs if they "
"have been loaded dynamically."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:228
msgid ""
"In the case of file system labels, special support is provided for the "
"persistent storage of security labels in extended attributes.  Where "
"available, extended attribute transactions are used to permit consistent "
"compound updates of security labels on vnodes--currently this support is "
"present only in the UFS2 file system.  Policy authors may choose to "
"implement multilabel file system object labels using one (or more) extended "
"attributes.  For efficiency reasons, the vnode label (`v_label`) is a cache "
"of any on-disk label; policies are able to load values into the cache when "
"the vnode is instantiated, and update the cache as needed.  As a result, the "
"extended attribute need not be directly accessed with every access control "
"check."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:232
msgid ""
"Currently, if a labeled policy permits dynamic unloading, its state slot "
"cannot be reclaimed, which places a strict (and relatively low) bound on the "
"number of unload-reload operations for labeled policies."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:235
#, no-wrap
msgid "System Calls"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:238
msgid ""
"The MAC Framework implements a number of system calls: most of these calls "
"support the policy-agnostic label retrieval and manipulation APIs exposed to "
"user applications."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:244
msgid ""
"The label management calls accept a label description structure, `struct "
"mac`, which contains a series of MAC label elements.  Each element contains "
"a character string name, and character string value.  Each policy will be "
"given the chance to claim a particular element name, permitting policies to "
"expose multiple independent elements if desired.  Policy modules perform the "
"internalization and externalization between kernel labels and user-provided "
"labels via entry points, permitting a variety of semantics.  Label "
"management system calls are generally wrapped by user library functions to "
"perform memory allocation and error handling, simplifying user applications "
"that must manage labels."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:246
msgid ""
"The following MAC-related system calls are present in the FreeBSD kernel:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:248
msgid ""
"`mac_get_proc()` may be used to retrieve the label of the current process."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:249
msgid ""
"`mac_set_proc()` may be used to request a change in the label of the current "
"process."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:250
msgid ""
"`mac_get_fd()` may be used to retrieve the label of an object (file, socket, "
"pipe, ...) referenced by a file descriptor."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:251
msgid ""
"`mac_get_file()` may be used to retrieve the label of an object referenced "
"by a file system path."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:252
msgid ""
"`mac_set_fd()` may be used to request a change in the label of an object "
"(file, socket, pipe, ...) referenced by a file descriptor."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:253
msgid ""
"`mac_set_file()` may be used to request a change in the label of an object "
"referenced by a file system path."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:254
msgid ""
"`mac_syscall()` permits policy modules to create new system calls without "
"modifying the system call table; it accepts a target policy name, operation "
"number, and opaque argument for use by the policy."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:255
msgid ""
"`mac_get_pid()` may be used to request the label of another process by "
"process id."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:256
msgid ""
"`mac_get_link()` is identical to `mac_get_file()`, only it will not follow a "
"symbolic link if it is the final entry in the path, so may be used to "
"retrieve the label on a symlink."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:257
msgid ""
"`mac_set_link()` is identical to `mac_set_file()`, only it will not follow a "
"symbolic link if it is the final entry in a path, so may be used to "
"manipulate the label on a symlink."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:259
msgid ""
"`mac_execve()` is identical to the `execve()` system call, only it also "
"accepts a requested label to set the process label to when beginning "
"execution of a new program.  This change in label on execution is referred "
"to as a \"transition\"."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:260
msgid ""
"`mac_get_peer()`, actually implemented via a socket option, retrieves the "
"label of a remote peer on a socket, if available."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:262
msgid ""
"In addition to these system calls, the `SIOCSIGMAC` and `SIOCSIFMAC` network "
"interface ioctls permit the labels on network interfaces to be retrieved and "
"set."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:264
#, no-wrap
msgid "MAC Policy Architecture"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:269
msgid ""
"Security policies are either linked directly into the kernel, or compiled "
"into loadable kernel modules that may be loaded at boot, or dynamically "
"using the module loading system calls at runtime.  Policy modules interact "
"with the system through a set of declared entry points, providing access to "
"a stream of system events and permitting the policy to influence access "
"control decisions.  Each policy contains a number of elements:"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:271
msgid "Optional configuration parameters for policy."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:272
msgid "Centralized implementation of the policy logic and parameters."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:273
msgid ""
"Optional implementation of policy life cycle events, such as initialization "
"and destruction."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:274
msgid ""
"Optional support for initializing, maintaining, and destroying labels on "
"selected kernel objects."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:275
msgid ""
"Optional support for user process inspection and modification of labels on "
"selected objects."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:276
msgid ""
"Implementation of selected access control entry points that are of interest "
"to the policy."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:277
msgid ""
"Declaration of policy identity, module entry points, and policy properties."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:279
#, no-wrap
msgid "Policy Declaration"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:282
msgid ""
"Modules may be declared using the `MAC_POLICY_SET()` macro, which names the "
"policy, provides a reference to the MAC entry point vector, provides load-"
"time flags determining how the policy framework should handle the policy, "
"and optionally requests the allocation of label state by the framework."
msgstr ""

#. type: delimited block . 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:296
#, no-wrap
msgid ""
"static struct mac_policy_ops mac_policy_ops =\n"
"{\n"
"        .mpo_destroy = mac_policy_destroy,\n"
"        .mpo_init = mac_policy_init,\n"
"        .mpo_init_bpfdesc_label = mac_policy_init_bpfdesc_label,\n"
"        .mpo_init_cred_label = mac_policy_init_label,\n"
"/* ... */\n"
"        .mpo_check_vnode_setutimes = mac_policy_check_vnode_setutimes,\n"
"        .mpo_check_vnode_stat = mac_policy_check_vnode_stat,\n"
"        .mpo_check_vnode_write = mac_policy_check_vnode_write,\n"
"};\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:305
msgid ""
"The MAC policy entry point vector, `mac__policy__ops` in this example, "
"associates functions defined in the module with specific entry points.  A "
"complete listing of available entry points and their prototypes may be found "
"in the MAC entry point reference section.  Of specific interest during "
"module registration are the .mpo_destroy and .mpo_init entry "
"points.  .mpo_init will be invoked once a policy is successfully registered "
"with the module framework but prior to any other entry points becoming "
"active.  This permits the policy to perform any policy-specific allocation "
"and initialization, such as initialization of any data or "
"locks.  .mpo_destroy will be invoked when a policy module is unloaded to "
"permit releasing of any allocated memory and destruction of locks.  "
"Currently, these two entry points are invoked with the MAC policy list mutex "
"held to prevent any other entry points from being invoked: this will be "
"changed, but in the mean time, policies should be careful about what kernel "
"primitives they invoke so as to avoid lock ordering or sleeping problems."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:309
msgid ""
"The policy declaration's module name field exists so that the module may be "
"uniquely identified for the purposes of module dependencies.  An appropriate "
"string should be selected.  The full string name of the policy is displayed "
"to the user via the kernel log during load and unload events, and also "
"exported when providing status information to userland processes."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:311
#, no-wrap
msgid "Policy Flags"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:315
msgid ""
"The policy declaration flags field permits the module to provide the "
"framework with information about its capabilities at the time the module is "
"loaded.  Currently, three flags are defined:"
msgstr ""

#. type: Labeled list
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:316
#, no-wrap
msgid "MPC_LOADTIME_FLAG_UNLOADOK"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:320
msgid ""
"This flag indicates that the policy module may be unloaded.  If this flag is "
"not provided, then the policy framework will reject requests to unload the "
"module.  This flag might be used by modules that allocate label state and "
"are unable to free that state at runtime."
msgstr ""

#. type: Labeled list
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:321
#, no-wrap
msgid "MPC_LOADTIME_FLAG_NOTLATE"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:325
msgid ""
"This flag indicates that the policy module must be loaded and initialized "
"early in the boot process.  If the flag is specified, attempts to register "
"the module following boot will be rejected.  The flag may be used by "
"policies that require pervasive labeling of all system objects, and cannot "
"handle objects that have not been properly initialized by the policy."
msgstr ""

#. type: Labeled list
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:326
#, no-wrap
msgid "MPC_LOADTIME_FLAG_LABELMBUFS"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:331
msgid ""
"This flag indicates that the policy module requires labeling of Mbufs, and "
"that memory should always be allocated for the storage of Mbuf labels.  By "
"default, the MAC Framework will not allocate label storage for Mbufs unless "
"at least one loaded policy has this flag set.  This measurably improves "
"network performance when policies do not require Mbuf labeling.  A kernel "
"option, `MAC_ALWAYS_LABEL_MBUF`, exists to force the MAC Framework to "
"allocate Mbuf label storage regardless of the setting of this flag, and may "
"be useful in some environments."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:337
msgid ""
"Policies using the `MPC_LOADTIME_FLAG_LABELMBUFS` without the "
"`MPC_LOADTIME_FLAG_NOTLATE` flag set must be able to correctly handle `NULL` "
"Mbuf label pointers passed into entry points.  This is necessary as in-"
"flight Mbufs without label storage may persist after a policy enabling Mbuf "
"labeling has been loaded.  If a policy is loaded before the network "
"subsystem is active (i.e., the policy is not being loaded late), then all "
"Mbufs are guaranteed to have label storage."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:340
#, no-wrap
msgid "Policy Entry Points"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:344
msgid ""
"Four classes of entry points are offered to policies registered with the "
"framework: entry points associated with the registration and management of "
"policies, entry points denoting initialization, creation, destruction, and "
"other life cycle events for kernel objects, events associated with access "
"control decisions that the policy module may influence, and calls associated "
"with the management of labels on objects.  In addition, a `mac_syscall()` "
"entry point is provided so that policies may extend the kernel interface "
"without registering new system calls."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:349
msgid ""
"Policy module writers should be aware of the kernel locking strategy, as "
"well as what object locks are available during which entry points.  Writers "
"should attempt to avoid deadlock scenarios by avoiding grabbing non-leaf "
"locks inside of entry points, and also follow the locking protocol for "
"object access and modification.  In particular, writers should be aware that "
"while necessary locks to access objects and their labels are generally held, "
"sufficient locks to modify an object or its label may not be present for all "
"entry points.  Locking information for arguments is documented in the MAC "
"framework entry point document."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:353
msgid ""
"Policy entry points will pass a reference to the object label along with the "
"object itself.  This permits labeled policies to be unaware of the internals "
"of the object yet still make decisions based on the label.  The exception to "
"this is the process credential, which is assumed to be understood by "
"policies as a first class security object in the kernel."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:355
#, no-wrap
msgid "MAC Policy Entry Point Reference"
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:358
#, no-wrap
msgid "General-Purpose Module Entry Points"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:361
#, no-wrap
msgid "`mpo_init`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:366
#, no-wrap
msgid "void mpo_init(struct mac_policy_conf *conf);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:372
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:396
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:419
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:457
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:486
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:509
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:532
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:555
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:578
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:607
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:636
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:663
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:686
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:709
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:736
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:763
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:786
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:809
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:832
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:855
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:878
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:901
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:924
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:947
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:970
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:997
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1020
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1043
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1066
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1089
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1112
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1138
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1164
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1191
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1231
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1271
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1311
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1351
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1391
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1431
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1468
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1505
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1542
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1579
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1664
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1707
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1745
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1780
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1812
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1845
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1889
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1942
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1978
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2000
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2035
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2071
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2111
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2147
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2179
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2212
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2247
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2282
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2317
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2354
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2393
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2424
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2452
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2487
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2522
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2557
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2593
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2629
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2665
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2701
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2745
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2781
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2819
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2854
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2891
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2921
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2959
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2991
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3013
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3035
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3095
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3130
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3152
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3178
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3204
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3231
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3261
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3283
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3306
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3345
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3376
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3407
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3442
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3473
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3504
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3537
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3574
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3605
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3635
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3665
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3694
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3729
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3763
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3790
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3825
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3858
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3888
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3926
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3959
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3990
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4033
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4080
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4117
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4151
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4188
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4235
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4278
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4313
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4348
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4379
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4415
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4459
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4507
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4540
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4577
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4614
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4647
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4681
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4714
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4755
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4803
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4840
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4877
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4919
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4959
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4989
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5022
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5057
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5098
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5139
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5172
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5202
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5224
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5250
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5273
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5304
#, no-wrap
msgid "Parameter"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:373
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:397
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:420
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:458
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:487
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:510
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:533
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:556
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:579
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:608
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:637
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:664
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:687
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:710
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:737
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:764
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:787
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:810
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:833
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:856
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:879
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:902
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:925
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:948
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:971
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:998
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1021
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1044
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1067
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1090
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1113
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1139
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1165
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1192
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1232
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1272
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1312
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1352
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1392
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1432
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1469
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1506
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1543
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1580
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1665
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1708
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1746
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1781
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1813
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1846
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1890
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1943
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1979
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2001
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2036
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2072
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2112
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2148
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2180
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2213
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2248
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2283
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2318
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2355
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2394
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2425
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2453
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2488
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2523
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2558
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2594
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2630
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2666
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2702
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2746
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2782
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2820
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2855
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2892
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2922
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2960
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2992
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3014
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3036
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3096
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3131
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3153
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3179
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3205
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3232
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3262
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3284
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3307
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3346
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3377
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3408
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3443
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3474
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3505
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3538
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3575
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3606
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3636
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3666
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3695
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3730
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3764
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3791
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3826
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3859
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3889
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3927
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3960
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3991
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4034
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4081
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4118
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4152
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4189
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4236
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4279
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4314
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4349
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4380
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4416
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4460
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4508
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4541
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4578
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4615
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4648
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4682
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4715
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4756
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4804
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4841
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4878
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4920
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4960
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4990
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5023
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5058
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5099
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5140
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5173
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5203
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5225
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5251
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5274
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5305
#, no-wrap
msgid "Description"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:375
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:399
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:422
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:460
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:489
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:512
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:535
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:558
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:581
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:610
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:639
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:666
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:689
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:712
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:739
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:766
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:789
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:812
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:835
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:858
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:881
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:904
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:927
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:950
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:973
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1000
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1023
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1046
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1069
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1092
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1115
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1141
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1167
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1194
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1234
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1274
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1314
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1354
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1394
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1434
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1471
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1508
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1545
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1582
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1667
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1710
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1748
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1783
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1815
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1848
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1892
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1945
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1981
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2003
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2038
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2074
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2114
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2150
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2182
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2215
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2250
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2285
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2320
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2357
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2396
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2427
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2455
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2490
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2525
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2560
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2596
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2632
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2668
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2704
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2748
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2784
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2822
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2857
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2894
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2924
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2962
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2994
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3016
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3038
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3098
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3133
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3155
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3181
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3207
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3234
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3264
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3286
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3309
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3348
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3379
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3410
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3445
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3476
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3507
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3540
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3577
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3608
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3638
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3668
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3697
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3732
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3766
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3793
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3828
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3861
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3891
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3929
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3962
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3993
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4036
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4083
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4120
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4154
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4191
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4238
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4281
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4316
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4351
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4382
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4418
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4462
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4510
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4543
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4580
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4617
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4650
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4684
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4717
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4758
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4806
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4843
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4880
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4922
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4962
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4992
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5025
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5060
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5101
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5142
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5175
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5205
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5227
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5253
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5276
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5307
#, no-wrap
msgid "Locking"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:376
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:400
#, no-wrap
msgid "`conf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:377
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:401
#, no-wrap
msgid "MAC policy definition"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:383
msgid ""
"Policy load event.  The policy list mutex is held, so sleep operations "
"cannot be performed, and calls out to other kernel subsystems must be made "
"with caution.  If potentially sleeping memory allocations are required "
"during policy initialization, they should be made using a separate module "
"SYSINIT()."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:385
#, no-wrap
msgid "`mpo_destroy`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:390
#, no-wrap
msgid "void mpo_destroy(struct mac_policy_conf *conf);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:406
msgid ""
"Policy load event.  The policy list mutex is held, so caution should be "
"applied."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:408
#, no-wrap
msgid "`mpo_syscall`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:413
#, no-wrap
msgid "int mpo_syscall(struct thread *td, int call, void *arg);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:423
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:461
#, no-wrap
msgid "`td`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:424
#, no-wrap
msgid "Calling thread"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:427
#, no-wrap
msgid "`call`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:428
#, no-wrap
msgid "Policy-specific syscall number"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:431
#, no-wrap
msgid "`arg`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:432
#, no-wrap
msgid "Pointer to syscall arguments"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:439
msgid ""
"This entry point provides a policy-multiplexed system call so that policies "
"may provide additional services to user processes without registering "
"specific system calls.  The policy name provided during registration is used "
"to demultiplexer calls from userland, and the arguments will be forwarded to "
"this entry point.  When implementing new services, security modules should "
"be sure to invoke appropriate access control checks from the MAC framework "
"as needed.  For example, if a policy implements an augmented signal "
"functionality, it should call the necessary signal access control checks to "
"invoke the MAC framework and other registered policies."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:443
msgid ""
"Modules must currently perform the `copyin()` of the syscall data on their "
"own."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:446
#, no-wrap
msgid "`mpo_thread_userret`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:451
#, no-wrap
msgid "void mpo_thread_userret(struct thread *td);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:462
#, no-wrap
msgid "Returning thread"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:470
msgid ""
"This entry point permits policy modules to perform MAC-related events when a "
"thread returns to user space, via a system call return, trap return, or "
"otherwise.  This is required for policies that have floating process labels, "
"as it is not always possible to acquire the process lock at arbitrary points "
"in the stack during system call processing; process labels might represent "
"traditional authentication data, process history information, or other "
"data.  To employ this mechanism, intended changes to the process credential "
"label may be stored in the `p_label` protected by a per-policy spin lock, "
"and then set the per-thread `TDF_ASTPENDING` flag and per-process "
"`PS_MACPENDM` flag to schedule a call to the `userret` entry point.  From "
"this entry point, the policy may create a replacement credential with less "
"concern about the locking context.  Policy writers are cautioned that event "
"ordering relating to scheduling an AST and the AST being performed may be "
"complex and interlaced in multithreaded applications."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:472
#, no-wrap
msgid "Label Operations"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:475
#, no-wrap
msgid "`mpo_init_bpfdesc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:480
#, no-wrap
msgid "void mpo_init_bpfdesc_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:490
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:513
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:536
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:559
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:582
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:615
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:667
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:690
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:713
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:740
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:767
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:790
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:813
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:836
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:859
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:882
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:905
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:928
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:951
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1001
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1047
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1070
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1093
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1195
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1235
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1275
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1315
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1355
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1395
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1435
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1472
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1509
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1546
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1583
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1792
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1901
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3900
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4053
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4092
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4129
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4163
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4200
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4255
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4290
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4325
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4395
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4435
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4479
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4589
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4659
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4693
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4726
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4767
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4815
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4852
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4889
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4931
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5034
#, no-wrap
msgid "`label`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:491
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:537
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:560
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:583
#, no-wrap
msgid "New label to apply"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:496
msgid ""
"Initialize the label on a newly instantiated bpfdesc (BPF descriptor).  "
"Sleeping is permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:498
#, no-wrap
msgid "`mpo_init_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:503
#, no-wrap
msgid "void mpo_init_cred_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:514
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:714
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:741
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:768
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:791
#, no-wrap
msgid "New label to initialize"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:519
msgid ""
"Initialize the label for a newly instantiated user credential.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:521
#, no-wrap
msgid "`mpo_init_devfsdirent_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:526
#, no-wrap
msgid "void mpo_init_devfsdirent_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:542
msgid ""
"Initialize the label on a newly instantiated devfs entry.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:544
#, no-wrap
msgid "`mpo_init_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:549
#, no-wrap
msgid "void mpo_init_ifnet_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:565
msgid ""
"Initialize the label on a newly instantiated network interface.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:567
#, no-wrap
msgid "`mpo_init_ipq_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:572
#, no-wrap
msgid "void mpo_init_ipq_label(struct label *label, int flag);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:586
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:611
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:717
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:744
#, no-wrap
msgid "`flag`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:587
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:612
#, no-wrap
msgid "Sleeping/non-sleeping man:malloc[9]; see below"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:594
msgid ""
"Initialize the label on a newly instantiated IP fragment reassembly queue.  "
"The `flag` field may be one of M_WAITOK and M_NOWAIT, and should be employed "
"to avoid performing a sleeping man:malloc[9] during this initialization "
"call.  IP fragment reassembly queue allocation frequently occurs in "
"performance sensitive environments, and the implementation should be careful "
"to avoid sleeping or long-lived operations.  This entry point is permitted "
"to fail resulting in the failure to allocate the IP fragment reassembly "
"queue."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:596
#, no-wrap
msgid "`mpo_init_mbuf_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:601
#, no-wrap
msgid "void mpo_init_mbuf_label(int flag, struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:616
#, no-wrap
msgid "Policy label to initialize"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:623
msgid ""
"Initialize the label on a newly instantiated mbuf packet header (`mbuf`).  "
"The `flag` field may be one of M_WAITOK and M_NOWAIT, and should be employed "
"to avoid performing a sleeping man:malloc[9] during this initialization "
"call.  Mbuf allocation frequently occurs in performance sensitive "
"environments, and the implementation should be careful to avoid sleeping or "
"long-lived operations.  This entry point is permitted to fail resulting in "
"the failure to allocate the mbuf header."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:625
#, no-wrap
msgid "`mpo_init_mount_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:630
#, no-wrap
msgid "void mpo_init_mount_label(struct label *mntlabel, struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:640
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:974
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1954
#, no-wrap
msgid "`mntlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:641
#, no-wrap
msgid "Policy label to be initialized for the mount itself"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:644
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:978
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1672
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1715
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1753
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1958
#, no-wrap
msgid "`fslabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:645
#, no-wrap
msgid "Policy label to be initialized for the file system"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:650
msgid ""
"Initialize the labels on a newly instantiated mount point.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:652
#, no-wrap
msgid "`mpo_init_mount_fs_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:657
#, no-wrap
msgid "void mpo_init_mount_fs_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:668
#, no-wrap
msgid "Label to be initialized"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:673
msgid ""
"Initialize the label on a newly mounted file system.  Sleeping is permitted"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:675
#, no-wrap
msgid "`mpo_init_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:680
#, no-wrap
msgid "void mpo_init_pipe_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:691
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1436
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1473
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1510
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1547
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1584
#, no-wrap
msgid "Label to be filled in"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:696
msgid ""
"Initialize a label for a newly instantiated pipe.  Sleeping is permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:698
#, no-wrap
msgid "`mpo_init_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:703
#, no-wrap
msgid "void mpo_init_socket_label(struct label *label, int flag);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:718
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:745
#, no-wrap
msgid "man:malloc[9] flags"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:723
msgid ""
"Initialize a label for a newly instantiated socket.  The `flag` field may be "
"one of M_WAITOK and M_NOWAIT, and should be employed to avoid performing a "
"sleeping man:malloc[9] during this initialization call."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:725
#, no-wrap
msgid "`mpo_init_socket_peer_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:730
#, no-wrap
msgid "void mpo_init_socket_peer_label(struct label *label, int flag);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:750
msgid ""
"Initialize the peer label for a newly instantiated socket.  The `flag` field "
"may be one of M_WAITOK and M_NOWAIT, and should be employed to avoid "
"performing a sleeping man:malloc[9] during this initialization call."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:752
#, no-wrap
msgid "`mpo_init_proc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:757
#, no-wrap
msgid "void mpo_init_proc_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:773
msgid ""
"Initialize the label for a newly instantiated process.  Sleeping is "
"permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:775
#, no-wrap
msgid "`mpo_init_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:780
#, no-wrap
msgid "void mpo_init_vnode_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:796
msgid ""
"Initialize the label on a newly instantiated vnode.  Sleeping is permitted."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:798
#, no-wrap
msgid "`mpo_destroy_bpfdesc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:803
#, no-wrap
msgid "void mpo_destroy_bpfdesc_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:814
#, no-wrap
msgid "bpfdesc label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:819
msgid ""
"Destroy the label on a BPF descriptor.  In this entry point a policy should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:821
#, no-wrap
msgid "`mpo_destroy_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:826
#, no-wrap
msgid "void mpo_destroy_cred_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:837
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:860
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:883
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:906
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:929
#, no-wrap
msgid "Label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:842
msgid ""
"Destroy the label on a credential.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:844
#, no-wrap
msgid "`mpo_destroy_devfsdirent_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:849
#, no-wrap
msgid "void mpo_destroy_devfsdirent_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:865
msgid ""
"Destroy the label on a devfs entry.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:867
#, no-wrap
msgid "`mpo_destroy_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:872
#, no-wrap
msgid "void mpo_destroy_ifnet_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:888
msgid ""
"Destroy the label on a removed interface.  In this entry point, a policy "
"module should free any internal storage associated with `label` so that it "
"may be destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:890
#, no-wrap
msgid "`mpo_destroy_ipq_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:895
#, no-wrap
msgid "void mpo_destroy_ipq_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:911
msgid ""
"Destroy the label on an IP fragment queue.  In this entry point, a policy "
"module should free any internal storage associated with `label` so that it "
"may be destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:913
#, no-wrap
msgid "`mpo_destroy_mbuf_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:918
#, no-wrap
msgid "void mpo_destroy_mbuf_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:934
msgid ""
"Destroy the label on an mbuf header.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:936
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:959
#, no-wrap
msgid "`mpo_destroy_mount_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:941
#, no-wrap
msgid "void mpo_destroy_mount_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:952
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:975
#, no-wrap
msgid "Mount point label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:957
msgid ""
"Destroy the labels on a mount point.  In this entry point, a policy module "
"should free the internal storage associated with `mntlabel` so that they may "
"be destroyed."
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:964
#, no-wrap
msgid "void mpo_destroy_mount_label(struct label *mntlabel, struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:979
#, no-wrap
msgid "File system label being destroyed>"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:984
msgid ""
"Destroy the labels on a mount point.  In this entry point, a policy module "
"should free the internal storage associated with `mntlabel` and `fslabel` so "
"that they may be destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:986
#, no-wrap
msgid "`mpo_destroy_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:991
#, no-wrap
msgid "void mpo_destroy_socket_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1002
#, no-wrap
msgid "Socket label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1007
msgid ""
"Destroy the label on a socket.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1009
#, no-wrap
msgid "`mpo_destroy_socket_peer_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1014
#, no-wrap
msgid "void mpo_destroy_socket_peer_label(struct label *peerlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1024
#, no-wrap
msgid "`peerlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1025
#, no-wrap
msgid "Socket peer label being destroyed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1030
msgid ""
"Destroy the peer label on a socket.  In this entry point, a policy module "
"should free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1032
#, no-wrap
msgid "`mpo_destroy_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1037
#, no-wrap
msgid "void mpo_destroy_pipe_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1048
#, no-wrap
msgid "Pipe label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1053
msgid ""
"Destroy the label on a pipe.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1055
#, no-wrap
msgid "`mpo_destroy_proc_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1060
#, no-wrap
msgid "void mpo_destroy_proc_label(struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1071
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1094
#, no-wrap
msgid "Process label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1076
msgid ""
"Destroy the label on a process.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1078
#, no-wrap
msgid "`mpo_destroy_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1083
#, no-wrap
msgid "void mpo_destroy_vnode_label(struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1099
msgid ""
"Destroy the label on a vnode.  In this entry point, a policy module should "
"free any internal storage associated with `label` so that it may be "
"destroyed."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1101
#, no-wrap
msgid "`mpo_copy_mbuf_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1106
#, no-wrap
msgid "void mpo_copy_mbuf_label(struct label *src, struct label *dest);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1116
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1142
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1168
#, no-wrap
msgid "`src`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1117
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1143
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1169
#, no-wrap
msgid "Source label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1120
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1146
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1172
#, no-wrap
msgid "`dest`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1121
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1147
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1173
#, no-wrap
msgid "Destination label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1125
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1151
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1177
msgid "Copy the label information in `src` into `dest`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1127
#, no-wrap
msgid "`mpo_copy_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1132
#, no-wrap
msgid "void mpo_copy_pipe_label(struct label *src, struct label *dest);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1153
#, no-wrap
msgid "`mpo_copy_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1158
#, no-wrap
msgid "void mpo_copy_vnode_label(struct label *src, struct label *dest);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1179
#, no-wrap
msgid "`mpo_externalize_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1185
#, no-wrap
msgid ""
"int mpo_externalize_cred_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1196
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1236
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1276
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1316
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1356
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1396
#, no-wrap
msgid "Label to be externalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1199
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1239
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1279
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1319
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1359
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1399
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1439
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1476
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1513
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1550
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1587
#, no-wrap
msgid "`element_name`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1200
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1240
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1280
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1320
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1360
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1400
#, no-wrap
msgid "Name of the policy whose label should be externalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1203
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1243
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1283
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1323
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1363
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1403
#, no-wrap
msgid "`sb`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1204
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1244
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1284
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1324
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1364
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1404
#, no-wrap
msgid "String buffer to be filled with a text representation of label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1207
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1247
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1287
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1327
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1367
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1407
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1447
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1484
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1521
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1558
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1595
#, no-wrap
msgid "`claimed`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1208
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1248
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1288
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1328
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1368
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1408
#, no-wrap
msgid "Should be incremented when `element_data` can be filled in."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1217
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1257
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1297
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1337
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1377
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1417
msgid ""
"Produce an externalized label based on the label structure passed.  An "
"externalized label consists of a text representation of the label contents "
"that can be used with userland applications and read by the user.  "
"Currently, all policies' `externalize` entry points will be called, so the "
"implementation should check the contents of `element_name` before attempting "
"to fill in `sb`.  If `element_name` does not match the name of your policy, "
"simply return 0.  Only return nonzero if an error occurs while externalizing "
"the label data.  Once the policy fills in `element_data`, `*claimed` should "
"be incremented."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1219
#, no-wrap
msgid "`mpo_externalize_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1225
#, no-wrap
msgid ""
"int mpo_externalize_ifnet_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1259
#, no-wrap
msgid "`mpo_externalize_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1265
#, no-wrap
msgid ""
"int mpo_externalize_pipe_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1299
#, no-wrap
msgid "`mpo_externalize_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1305
#, no-wrap
msgid ""
"int mpo_externalize_socket_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1339
#, no-wrap
msgid "`mpo_externalize_socket_peer_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1345
#, no-wrap
msgid ""
"int mpo_externalize_socket_peer_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1379
#, no-wrap
msgid "`mpo_externalize_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1385
#, no-wrap
msgid ""
"int mpo_externalize_vnode_label(struct label *label, char *element_name,\n"
"    struct sbuf *sb, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1419
#, no-wrap
msgid "`mpo_internalize_cred_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1425
#, no-wrap
msgid ""
"int mpo_internalize_cred_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1440
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1477
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1514
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1551
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1588
#, no-wrap
msgid "Name of the policy whose label should be internalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1443
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1480
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1517
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1554
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1591
#, no-wrap
msgid "`element_data`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1444
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1481
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1518
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1555
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1592
#, no-wrap
msgid "Text data to be internalized"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1448
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1485
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1522
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1559
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1596
#, no-wrap
msgid "Should be incremented when data can be successfully internalized."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1454
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1491
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1528
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1565
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1602
msgid ""
"Produce an internal label structure based on externalized label data in text "
"format.  Currently, all policies' `internalize` entry points are called when "
"internalization is requested, so the implementation should compare the "
"contents of `element_name` to its own name in order to be sure it should be "
"internalizing the data in `element_data`.  Just as in the `externalize` "
"entry points, the entry point should return 0 if `element_name` does not "
"match its own name, or when data can successfully be internalized, in which "
"case `*claimed` should be incremented."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1456
#, no-wrap
msgid "`mpo_internalize_ifnet_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1462
#, no-wrap
msgid ""
"int mpo_internalize_ifnet_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1493
#, no-wrap
msgid "`mpo_internalize_pipe_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1499
#, no-wrap
msgid ""
"int mpo_internalize_pipe_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1530
#, no-wrap
msgid "`mpo_internalize_socket_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1536
#, no-wrap
msgid ""
"int mpo_internalize_socket_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1567
#, no-wrap
msgid "`mpo_internalize_vnode_label`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1573
#, no-wrap
msgid ""
"int mpo_internalize_vnode_label(struct label *label, char *element_name,\n"
"    char *element_data, int *claimed);\n"
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1604
#, no-wrap
msgid "Label Events"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1612
msgid ""
"This class of entry points is used by the MAC framework to permit policies "
"to maintain label information on kernel objects.  For each labeled kernel "
"object of interest to a MAC policy, entry points may be registered for "
"relevant life cycle events.  All objects implement initialization, creation, "
"and destruction hooks.  Some objects will also implement relabeling, "
"allowing user processes to change the labels on objects.  Some objects will "
"also implement object-specific events, such as label events associated with "
"IP reassembly.  A typical labeled object will have the following life cycle "
"of entry points:"
msgstr ""

#. type: delimited block . 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1624
#, no-wrap
msgid ""
"Label initialization          o\n"
"(object-specific wait)         \\\n"
"Label creation                  o\n"
"                                 \\\n"
"Relabel events,                   o--<--.\n"
"Various object-specific,          |     |\n"
"Access control events             ~-->--o\n"
"                                         \\\n"
"Label destruction                         o\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1628
msgid ""
"Label initialization permits policies to allocate memory and set initial "
"values for labels without context for the use of the object.  The label slot "
"allocated to a policy will be zeroed by default, so some policies may not "
"need to perform initialization."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1635
msgid ""
"Label creation occurs when the kernel structure is associated with an actual "
"kernel object.  For example, Mbufs may be allocated and remain unused in a "
"pool until they are required.  mbuf allocation causes label initialization "
"on the mbuf to take place, but mbuf creation occurs when the mbuf is "
"associated with a datagram.  Typically, context will be provided for a "
"creation event, including the circumstances of the creation, and labels of "
"other relevant objects in the creation process.  For example, when an mbuf "
"is created from a socket, the socket and its label will be presented to "
"registered policies in addition to the new mbuf and its label.  Memory "
"allocation in creation events is discouraged, as it may occur in performance "
"sensitive ports of the kernel; in addition, creation calls are not permitted "
"to fail so a failure to allocate memory cannot be reported."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1638
msgid ""
"Object specific events do not generally fall into the other broad classes of "
"label events, but will generally provide an opportunity to modify or update "
"the label on an object based on additional context.  For example, the label "
"on an IP fragment reassembly queue may be updated during the MAC_UPDATE_IPQ "
"entry point as a result of the acceptance of an additional mbuf to that "
"queue."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1640
msgid "Access control events are discussed in detail in the following section."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1642
msgid ""
"Label destruction permits policies to release storage or state associated "
"with a label during its association with an object so that the kernel data "
"structures supporting the object may be reused or released."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1646
msgid ""
"In addition to labels associated with specific kernel objects, an additional "
"class of labels exists: temporary labels.  These labels are used to store "
"update information submitted by user processes.  These labels are "
"initialized and destroyed as with other label types, but the creation event "
"is MAC_INTERNALIZE, which accepts a user label to be converted to an in-"
"kernel representation."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1648
#, no-wrap
msgid "File System Object Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1651
#, no-wrap
msgid "`mpo_associate_vnode_devfs`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1658
#, no-wrap
msgid ""
"void mpo_associate_vnode_devfs(struct mount *mp, struct label *fslabel,\n"
"    struct devfs_dirent *de, struct label *delabel, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1668
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1711
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1749
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1853
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1950
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3833
#, no-wrap
msgid "`mp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1669
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1854
#, no-wrap
msgid "Devfs mount point"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1673
#, no-wrap
msgid "Devfs file system label (`mp->mnt_fslabel`)"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1676
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1865
#, no-wrap
msgid "`de`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1677
#, no-wrap
msgid "Devfs directory entry"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1680
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1869
#, no-wrap
msgid "`delabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1681
#, no-wrap
msgid "Policy label associated with `de`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1684
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1719
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1757
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1913
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2008
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2043
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2083
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2933
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2967
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3239
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3798
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3896
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4049
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4088
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4125
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4159
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4196
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4251
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4286
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4321
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4356
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4391
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4431
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4475
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4585
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4655
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4689
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4722
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4763
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4811
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4848
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4885
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4927
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5030
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5180
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5281
#, no-wrap
msgid "`vp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1685
#, no-wrap
msgid "vnode associated with `de`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1688
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1723
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1761
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1917
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2047
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3243
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5184
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5285
#, no-wrap
msgid "`vlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1689
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1724
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1762
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1918
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2048
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4256
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4291
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4396
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4436
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4480
#, no-wrap
msgid "Policy label associated with `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1693
msgid ""
"Fill in the label (`vlabel`) for a newly created devfs vnode based on the "
"devfs directory entry passed in `de` and its label."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1695
#, no-wrap
msgid "`mpo_associate_vnode_extattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1701
#, no-wrap
msgid ""
"int mpo_associate_vnode_extattr(struct mount *mp, struct label *fslabel,\n"
"    struct vnode *vp, struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1712
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1750
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1898
#, no-wrap
msgid "File system mount point"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1716
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1754
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1902
#, no-wrap
msgid "File system label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1720
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1758
#, no-wrap
msgid "Vnode to label"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1731
msgid ""
"Attempt to retrieve the label for `vp` from the file system extended "
"attributes.  Upon success, the value `0` is returned.  Should extended "
"attribute retrieval not be supported, an accepted fallback is to copy "
"`fslabel` into `vlabel`.  In the event of an error, an appropriate value for "
"`errno` should be returned."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1733
#, no-wrap
msgid "`mpo_associate_vnode_singlelabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1739
#, no-wrap
msgid ""
"void mpo_associate_vnode_singlelabel(struct mount *mp, struct label *fslabel,\n"
"    struct vnode *vp, struct label *vlabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1766
msgid ""
"On non-multilabel file systems, this entry point is called to set the policy "
"label for `vp` based on the file system label, `fslabel`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1768
#, no-wrap
msgid "`mpo_create_devfs_device`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1774
#, no-wrap
msgid ""
"void mpo_create_devfs_device(dev_t dev, struct devfs_dirent *devfs_dirent,\n"
"    struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1784
#, no-wrap
msgid "`dev`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1785
#, no-wrap
msgid "Device corresponding with `devfs_dirent`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1788
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1824
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2075
#, no-wrap
msgid "`devfs_dirent`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1789
#, no-wrap
msgid "Devfs directory entry to be labeled."
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1793
#, no-wrap
msgid "Label for `devfs_dirent` to be filled in."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1798
msgid ""
"Fill out the label on a devfs_dirent being created for the passed device.  "
"This call will be made when the device file system is mounted, regenerated, "
"or a new device is made available."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1800
#, no-wrap
msgid "`mpo_create_devfs_directory`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1806
#, no-wrap
msgid ""
"void mpo_create_devfs_directory(char *dirname, int dirnamelen,\n"
"    struct devfs_dirent *devfs_dirent, struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1816
#, no-wrap
msgid "`dirname`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1817
#, no-wrap
msgid "Name of directory being created"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1820
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5316
#, no-wrap
msgid "`namelen`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1821
#, no-wrap
msgid "Length of string `dirname`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1825
#, no-wrap
msgid "Devfs directory entry for directory being created."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1830
msgid ""
"Fill out the label on a devfs_dirent being created for the passed "
"directory.  This call will be made when the device file system is mounted, "
"regenerated, or a new device requiring a specific directory hierarchy is "
"made available."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1832
#, no-wrap
msgid "`mpo_create_devfs_symlink`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1839
#, no-wrap
msgid ""
"void mpo_create_devfs_symlink(struct ucred *cred, struct mount *mp,\n"
"    struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,\n"
"    struct label *delabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1849
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1893
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1946
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2004
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2039
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2151
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2183
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2251
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2286
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2397
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2823
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2995
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3017
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3039
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3134
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3156
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3182
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3208
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3235
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3265
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3287
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3310
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3349
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3380
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3411
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3446
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3477
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3508
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3541
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3578
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3609
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3669
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3698
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3733
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3767
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3794
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3829
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3862
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3892
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3930
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3963
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3994
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4037
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4084
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4121
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4155
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4192
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4239
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4282
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4317
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4352
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4419
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4463
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4511
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4544
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4581
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4618
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4651
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4685
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4718
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4759
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4807
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4844
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4881
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4923
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4963
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4993
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5026
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5061
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5102
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5143
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5206
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5228
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5254
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5277
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5308
#, no-wrap
msgid "`cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1850
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1894
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1947
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2005
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2040
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2152
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2184
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2252
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2287
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2398
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2824
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3040
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3135
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3157
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3183
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3209
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3236
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3266
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3288
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3311
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3350
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3381
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3412
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3447
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3478
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3509
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3542
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3579
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3610
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3640
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3670
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3699
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3734
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3768
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3795
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3830
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3863
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3893
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3931
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3964
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3995
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4038
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4085
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4122
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4156
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4193
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4240
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4283
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4353
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4384
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4420
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4464
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4512
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4545
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4582
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4619
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4652
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4686
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4719
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4760
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4808
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4845
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4882
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4924
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4964
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4994
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5027
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5062
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5103
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5144
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5177
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5207
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5229
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5255
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5278
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5309
#, no-wrap
msgid "Subject credential"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1857
#, no-wrap
msgid "`dd`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1858
#, no-wrap
msgid "Link destination"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1861
#, no-wrap
msgid "`ddlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1862
#, no-wrap
msgid "Label associated with `dd`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1866
#, no-wrap
msgid "Symlink entry"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1870
#, no-wrap
msgid "Label associated with `de`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1874
msgid ""
"Fill in the label (`delabel`) for a newly created man:devfs[5] symbolic link "
"entry."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1876
#, no-wrap
msgid "`mpo_create_vnode_extattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1883
#, no-wrap
msgid ""
"int mpo_create_vnode_extattr(struct ucred *cred, struct mount *mp,\n"
"    struct label *fslabel, struct vnode *dvp, struct label *dlabel,\n"
"    struct vnode *vp, struct label *vlabel, struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1897
#, no-wrap
msgid "`mount`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1905
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3934
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3967
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3998
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4041
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4243
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4423
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4467
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4548
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4622
#, no-wrap
msgid "`dvp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1906
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4042
#, no-wrap
msgid "Parent directory vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1909
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3938
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3971
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4002
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4045
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4247
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4427
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4471
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4552
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4626
#, no-wrap
msgid "`dlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1910
#, no-wrap
msgid "Label associated with `dvp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1914
#, no-wrap
msgid "Newly created vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1921
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4006
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4057
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4259
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4439
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4487
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4556
#, no-wrap
msgid "`cnp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1922
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4058
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4440
#, no-wrap
msgid "Component name for `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1928
msgid ""
"Write out the label for `vp` to the appropriate extended attribute.  If the "
"write succeeds, fill in `vlabel` with the label, and return 0.  Otherwise, "
"return an appropriate error."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1930
#, no-wrap
msgid "`mpo_create_mount`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1936
#, no-wrap
msgid ""
"void mpo_create_mount(struct ucred *cred, struct mount *mp, struct label *mnt,\n"
"    struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1951
#, no-wrap
msgid "Object; file system being mounted"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1955
#, no-wrap
msgid "Policy label to be filled in for `mp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1959
#, no-wrap
msgid "Policy label for the file system `mp` mounts."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1964
msgid ""
"Fill out the labels on the mount point being created by the passed subject "
"credential.  This call will be made when a new file system is mounted."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1966
#, no-wrap
msgid "`mpo_create_root_mount`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1972
#, no-wrap
msgid ""
"void mpo_create_root_mount(struct ucred *cred, struct mount *mp,\n"
"    struct label *mntlabel, struct label *fslabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1982
#, no-wrap
msgid "See crossref:mac[mac-mpo-create-mount, `mpo_create_mount`]."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1986
msgid ""
"Fill out the labels on the mount point being created by the passed subject "
"credential.  This call will be made when the root file system is mounted, "
"after `mpo_create_mount;`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1988
#, no-wrap
msgid "`mpo_relabel_vnode`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:1994
#, no-wrap
msgid ""
"void mpo_relabel_vnode(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vnodelabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2009
#, no-wrap
msgid "vnode to relabel"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2012
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2087
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2937
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2971
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3802
#, no-wrap
msgid "`vnodelabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2013
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3803
#, no-wrap
msgid "Existing policy label for `vp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2016
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2263
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2298
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2333
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2835
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3043
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3423
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3710
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3745
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3771
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3806
#, no-wrap
msgid "`newlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2017
#, no-wrap
msgid "New, possibly partial label to replace `vnodelabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2021
msgid ""
"Update the label on the passed vnode given the passed update vnode label and "
"the passed subject credential."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2023
#, no-wrap
msgid "`mpo_setlabel_vnode_extattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2029
#, no-wrap
msgid ""
"int mpo_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vlabel, struct label *intlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2044
#, no-wrap
msgid "Vnode for which the label is being written"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2051
#, no-wrap
msgid "`intlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2052
#, no-wrap
msgid "Label to write out"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2057
msgid ""
"Write out the policy from `intlabel` to an extended attribute.  This is "
"called from `vop_stdcreatevnode_ea`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2059
#, no-wrap
msgid "`mpo_update_devfsdirent`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2065
#, no-wrap
msgid ""
"void mpo_update_devfsdirent(struct devfs_dirent *devfs_dirent,\n"
"    struct label *direntlabel, struct vnode *vp, struct label *vnodelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2076
#, no-wrap
msgid "Object; devfs directory entry"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2079
#, no-wrap
msgid "`direntlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2080
#, no-wrap
msgid "Policy label for `devfs_dirent` to be updated."
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2084
#, no-wrap
msgid "Parent vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2086
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2936
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3801
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4091
#, no-wrap
msgid "Locked"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2088
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2938
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2972
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3901
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4054
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4093
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4130
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4164
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4201
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4590
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4660
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4694
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4727
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4768
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4816
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4853
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4890
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4932
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5035
#, no-wrap
msgid "Policy label for `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2094
msgid ""
"Update the `devfs_dirent` label from the passed devfs vnode label.  This "
"call will be made when a devfs vnode has been successfully relabeled to "
"commit the label change such that it lasts even if the vnode is recycled.  "
"It will also be made when a symlink is created in devfs, following a call to "
"`mac_vnode_create_from_vnode` to initialize the vnode label."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2096
#, no-wrap
msgid "IPC Object Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2099
#, no-wrap
msgid "`mpo_create_mbuf_from_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2105
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,\n"
"    struct mbuf *m, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2115
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3512
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3545
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3673
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3737
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4515
#, no-wrap
msgid "`socket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2116
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3583
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3614
#, no-wrap
msgid "Socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2118
#, no-wrap
msgid "Socket locking WIP"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2119
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2191
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3516
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3549
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3586
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3617
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3677
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3741
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4519
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5151
#, no-wrap
msgid "`socketlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2120
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3517
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3550
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3678
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4520
#, no-wrap
msgid "Policy label for `socket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2123
#, no-wrap
msgid "`m`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2124
#, no-wrap
msgid "Object; mbuf"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2127
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2325
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2609
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2645
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2681
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2862
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5077
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5118
#, no-wrap
msgid "`mbuflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2128
#, no-wrap
msgid "Policy label to fill in for `m`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2133
msgid ""
"Set the label on a newly created mbuf header from the passed socket label.  "
"This call is made when a new datagram or message is generated by the socket "
"and stored in the passed mbuf."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2135
#, no-wrap
msgid "`mpo_create_pipe`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2141
#, no-wrap
msgid ""
"void mpo_create_pipe(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2155
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2255
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3314
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3353
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3384
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3415
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3450
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3481
#, no-wrap
msgid "`pipe`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2156
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2256
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3315
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3354
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3385
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3416
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3451
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3482
#, no-wrap
msgid "Pipe"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2159
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3318
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3357
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3388
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3419
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3454
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3485
#, no-wrap
msgid "`pipelabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2160
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3319
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3358
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3389
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3455
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3486
#, no-wrap
msgid "Policy label associated with `pipe`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2165
msgid ""
"Set the label on a newly created pipe from the passed subject credential.  "
"This call is made when a new pipe is created."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2167
#, no-wrap
msgid "`mpo_create_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2173
#, no-wrap
msgid ""
"void mpo_create_socket(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2186
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2289
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2400
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2928
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2966
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3797
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3865
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4087
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5146
#, no-wrap
msgid "Immutable"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2187
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2290
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3582
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3613
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5147
#, no-wrap
msgid "`so`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2188
#, no-wrap
msgid "Object; socket to label"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2192
#, no-wrap
msgid "Label to fill in for `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2197
msgid ""
"Set the label on a newly created socket from the passed subject credential.  "
"This call is made when a socket is created."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2199
#, no-wrap
msgid "`mpo_create_socket_from_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2206
#, no-wrap
msgid ""
"void mpo_create_socket_from_socket(struct socket *oldsocket,\n"
"    struct label *oldsocketlabel, struct socket *newsocket,\n"
"    struct label *newsocketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2216
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2358
#, no-wrap
msgid "`oldsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2217
#, no-wrap
msgid "Listening socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2220
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2362
#, no-wrap
msgid "`oldsocketlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2221
#, no-wrap
msgid "Policy label associated with `oldsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2224
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2366
#, no-wrap
msgid "`newsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2225
#, no-wrap
msgid "New socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2228
#, no-wrap
msgid "`newsocketlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2229
#, no-wrap
msgid "Policy label associated with `newsocketlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2233
msgid ""
"Label a socket, `newsocket`, newly man:accept[2]ed, based on the "
"man:listen[2] socket, `oldsocket`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2235
#, no-wrap
msgid "`mpo_relabel_pipe`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2241
#, no-wrap
msgid ""
"void mpo_relabel_pipe(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *oldlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2259
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2294
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2329
#, no-wrap
msgid "`oldlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2260
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3420
#, no-wrap
msgid "Current policy label associated with `pipe`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2264
#, no-wrap
msgid "Policy label update to apply to `pipe`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2268
msgid "Apply a new label, `newlabel`, to `pipe`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2270
#, no-wrap
msgid "`mpo_relabel_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2276
#, no-wrap
msgid ""
"void mpo_relabel_socket(struct ucred *cred, struct socket *so,\n"
"    struct label *oldlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2291
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3674
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3738
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4516
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5148
#, no-wrap
msgid "Object; socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2295
#, no-wrap
msgid "Current label for `so`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2299
#, no-wrap
msgid "Label update for `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2303
msgid "Update the label on a socket from the passed socket label update."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2305
#, no-wrap
msgid "`mpo_set_socket_peer_from_mbuf`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2311
#, no-wrap
msgid ""
"void mpo_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel,\n"
"    struct label *oldlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2321
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2605
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2641
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2677
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2858
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5073
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5114
#, no-wrap
msgid "`mbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2322
#, no-wrap
msgid "First datagram received over socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2326
#, no-wrap
msgid "Label for `mbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2330
#, no-wrap
msgid "Current label for the socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2334
#, no-wrap
msgid "Policy label to be filled out for the socket"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2339
msgid ""
"Set the peer label on a stream socket from the passed mbuf label.  This call "
"will be made when the first datagram is received by the stream socket, with "
"the exception of Unix domain sockets."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2341
#, no-wrap
msgid "`mpo_set_socket_peer_from_socket`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2348
#, no-wrap
msgid ""
"void mpo_set_socket_peer_from_socket(struct socket *oldsocket,\n"
"    struct label *oldsocketlabel, struct socket *newsocket,\n"
"    struct label *newsocketpeerlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2359
#, no-wrap
msgid "Local socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2363
#, no-wrap
msgid "Policy label for `oldsocket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2367
#, no-wrap
msgid "Peer socket"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2370
#, no-wrap
msgid "`newsocketpeerlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2371
#, no-wrap
msgid "Policy label to fill in for `newsocket`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2376
msgid ""
"Set the peer label on a stream UNIX domain socket from the passed remote "
"socket endpoint.  This call will be made when the socket pair is connected, "
"and will be made for both endpoints."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2378
#, no-wrap
msgid "Network Object Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2381
#, no-wrap
msgid "`mpo_create_bpfdesc`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2387
#, no-wrap
msgid ""
"void mpo_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,\n"
"    struct label *bpflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2401
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2633
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3099
#, no-wrap
msgid "`bpf_d`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2402
#, no-wrap
msgid "Object; bpf descriptor"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2405
#, no-wrap
msgid "`bpf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2406
#, no-wrap
msgid "Policy label to be filled in for `bpf_d`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2411
msgid ""
"Set the label on a newly created BPF descriptor from the passed subject "
"credential.  This call will be made when a BPF device node is opened by a "
"process with the passed subject credential."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2413
#, no-wrap
msgid "`mpo_create_ifnet`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2418
#, no-wrap
msgid "void mpo_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2428
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2597
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2669
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2713
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2827
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3107
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3702
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5065
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5106
#, no-wrap
msgid "`ifnet`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2429
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2598
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2670
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2714
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5066
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5107
#, no-wrap
msgid "Network interface"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2432
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2601
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2673
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2717
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2831
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3111
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3706
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5069
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5110
#, no-wrap
msgid "`ifnetlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2433
#, no-wrap
msgid "Policy label to fill in for `ifnet`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2438
msgid ""
"Set the label on a newly created interface.  This call may be made when a "
"new physical interface becomes available to the system, or when a pseudo-"
"interface is instantiated during the boot or as a result of a user action."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2440
#, no-wrap
msgid "`mpo_create_ipq`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2446
#, no-wrap
msgid ""
"void mpo_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,\n"
"    struct ipq *ipq, struct label *ipqlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2456
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2534
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2785
#, no-wrap
msgid "`fragment`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2457
#, no-wrap
msgid "First received IP fragment"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2460
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2538
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2789
#, no-wrap
msgid "`fragmentlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2461
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2790
#, no-wrap
msgid "Policy label for `fragment`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2464
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2491
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2793
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2866
#, no-wrap
msgid "`ipq`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2465
#, no-wrap
msgid "IP reassembly queue to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2468
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2495
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2797
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2870
#, no-wrap
msgid "`ipqlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2469
#, no-wrap
msgid "Policy label to be filled in for `ipq`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2473
msgid ""
"Set the label on a newly created IP fragment reassembly queue from the mbuf "
"header of the first received fragment."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2475
#, no-wrap
msgid "`mpo_create_datagram_from_ipq`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2481
#, no-wrap
msgid ""
"void mpo_create_create_datagram_from_ipq(struct ipq *ipq,\n"
"    struct label *ipqlabel, struct mbuf *datagram, struct label *datagramlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2492
#, no-wrap
msgid "IP reassembly queue"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2496
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2798
#, no-wrap
msgid "Policy label for `ipq`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2499
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2526
#, no-wrap
msgid "`datagram`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2500
#, no-wrap
msgid "Datagram to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2503
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2530
#, no-wrap
msgid "`datagramlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2504
#, no-wrap
msgid "Policy label to be filled in for `datagramlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2508
msgid ""
"Set the label on a newly reassembled IP datagram from the IP fragment "
"reassembly queue from which it was generated."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2510
#, no-wrap
msgid "`mpo_create_fragment`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2516
#, no-wrap
msgid ""
"void mpo_create_fragment(struct mbuf *datagram, struct label *datagramlabel,\n"
"    struct mbuf *fragment, struct label *fragmentlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2527
#, no-wrap
msgid "Datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2531
#, no-wrap
msgid "Policy label for `datagram`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2535
#, no-wrap
msgid "Fragment to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2539
#, no-wrap
msgid "Policy label to be filled in for `datagram`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2543
msgid ""
"Set the label on the mbuf header of a newly created IP fragment from the "
"label on the mbuf header of the datagram it was generate from."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2545
#, no-wrap
msgid "`mpo_create_mbuf_from_mbuf`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2551
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_mbuf(struct mbuf *oldmbuf, struct label *oldmbuflabel,\n"
"    struct mbuf *newmbuf, struct label *newmbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2561
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2705
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2749
#, no-wrap
msgid "`oldmbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2562
#, no-wrap
msgid "Existing (source) mbuf"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2565
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2709
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2753
#, no-wrap
msgid "`oldmbuflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2566
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2710
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2754
#, no-wrap
msgid "Policy label for `oldmbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2569
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2721
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2757
#, no-wrap
msgid "`newmbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2570
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2642
#, no-wrap
msgid "New mbuf to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2573
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2725
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2761
#, no-wrap
msgid "`newmbuflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2574
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2726
#, no-wrap
msgid "Policy label to be filled in for `newmbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2579
msgid ""
"Set the label on the mbuf header of a newly created datagram from the mbuf "
"header of an existing datagram.  This call may be made in a number of "
"situations, including when an mbuf is re-allocated for alignment purposes."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2581
#, no-wrap
msgid "`mpo_create_mbuf_linklayer`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2587
#, no-wrap
msgid ""
"void mpo_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel,\n"
"    struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2602
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2718
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2832
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3112
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5070
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5111
#, no-wrap
msgid "Policy label for `ifnet`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2606
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2678
#, no-wrap
msgid "mbuf header for new datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2610
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2682
#, no-wrap
msgid "Policy label to be filled in for `mbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2615
msgid ""
"Set the label on the mbuf header of a newly created datagram generated for "
"the purposes of a link layer response for the passed interface.  This call "
"may be made in a number of situations, including for ARP or ND6 responses in "
"the IPv4 and IPv6 stacks."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2617
#, no-wrap
msgid "`mpo_create_mbuf_from_bpfdesc`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2623
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel,\n"
"    struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2634
#, no-wrap
msgid "BPF descriptor"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2637
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3103
#, no-wrap
msgid "`bpflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2638
#, no-wrap
msgid "Policy label for `bpflabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2646
#, no-wrap
msgid "Policy label to fill in for `mbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2651
msgid ""
"Set the label on the mbuf header of a newly created datagram generated using "
"the passed BPF descriptor.  This call is made when a write is performed to "
"the BPF device associated with the passed BPF descriptor."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2653
#, no-wrap
msgid "`mpo_create_mbuf_from_ifnet`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2659
#, no-wrap
msgid ""
"void mpo_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel,\n"
"    struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2674
#, no-wrap
msgid "Policy label for `ifnetlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2686
msgid ""
"Set the label on the mbuf header of a newly created datagram generated from "
"the passed network interface."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2688
#, no-wrap
msgid "`mpo_create_mbuf_multicast_encap`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2695
#, no-wrap
msgid ""
"void mpo_create_mbuf_multicast_encap(struct mbuf *oldmbuf,\n"
"    struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel,\n"
"    struct mbuf *newmbuf, struct label *newmbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2706
#, no-wrap
msgid "mbuf header for existing datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2722
#, no-wrap
msgid "mbuf header to be labeled for new datagram"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2731
msgid ""
"Set the label on the mbuf header of a newly created datagram generated from "
"the existing passed datagram when it is processed by the passed multicast "
"encapsulation interface.  This call is made when an mbuf is to be delivered "
"using the virtual interface."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2733
#, no-wrap
msgid "`mpo_create_mbuf_netlayer`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2739
#, no-wrap
msgid ""
"void mpo_create_mbuf_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel,\n"
"    struct mbuf *newmbuf, struct label *newmbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2750
#, no-wrap
msgid "Received datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2758
#, no-wrap
msgid "Newly created datagram"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2762
#, no-wrap
msgid "Policy label for `newmbuf`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2767
msgid ""
"Set the label on the mbuf header of a newly created datagram generated by "
"the IP stack in response to an existing received datagram (`oldmbuf`).  This "
"call may be made in a number of situations, including when responding to "
"ICMP request datagrams."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2769
#, no-wrap
msgid "`mpo_fragment_match`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2775
#, no-wrap
msgid ""
"int mpo_fragment_match(struct mbuf *fragment, struct label *fragmentlabel,\n"
"    struct ipq *ipq, struct label *ipqlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2786
#, no-wrap
msgid "IP datagram fragment"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2794
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2867
#, no-wrap
msgid "IP fragment reassembly queue"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2805
msgid ""
"Determine whether an mbuf header containing an IP datagram (`fragment`) "
"fragment matches the label of the passed IP fragment reassembly queue "
"(`ipq`).  Return (1) for a successful match, or (0) for no match.  This call "
"is made when the IP stack attempts to find an existing fragment reassembly "
"queue for a newly received fragment; if this fails, a new fragment "
"reassembly queue may be instantiated for the fragment.  Policies may use "
"this entry point to prevent the reassembly of otherwise matching IP "
"fragments if policy does not permit them to be reassembled based on the "
"label or other information."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2807
#, no-wrap
msgid "`mpo_relabel_ifnet`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2813
#, no-wrap
msgid ""
"void mpo_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2828
#, no-wrap
msgid "Object; Network interface"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2836
#, no-wrap
msgid "Label update to apply to `ifnet`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2840
msgid ""
"Update the label of network interface, `ifnet`, based on the passed update "
"label, `newlabel`, and the passed subject credential, `cred`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2842
#, no-wrap
msgid "`mpo_update_ipq`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2848
#, no-wrap
msgid ""
"void mpo_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,\n"
"    struct ipq *ipq, struct label *ipqlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2859
#, no-wrap
msgid "IP fragment"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2863
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5078
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5119
#, no-wrap
msgid "Policy label for `mbuf`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2871
#, no-wrap
msgid "Policy label to be updated for `ipq`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2875
msgid ""
"Update the label on an IP fragment reassembly queue (`ipq`) based on the "
"acceptance of the passed IP fragment mbuf header (`mbuf`)."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2877
#, no-wrap
msgid "Process Labeling Event Operations"
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2880
#, no-wrap
msgid "`mpo_create_cred`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2885
#, no-wrap
msgid "void mpo_create_cred(struct ucred *parent_cred, struct ucred *child_cred);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2895
#, no-wrap
msgid "`parent_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2896
#, no-wrap
msgid "Parent subject credential"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2899
#, no-wrap
msgid "`child_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2900
#, no-wrap
msgid "Child subject credential"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2906
msgid ""
"Set the label of a newly created subject credential from the passed subject "
"credential.  This call will be made when man:crcopy[9] is invoked on a newly "
"created `struct ucred`.  This call should not be confused with a process "
"forking or creation event."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2908
#, no-wrap
msgid "`mpo_execve_transition`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2914
#, no-wrap
msgid ""
"void mpo_execve_transition(struct ucred *old, struct ucred *new,\n"
"    struct vnode *vp, struct label *vnodelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2925
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2963
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5320
#, no-wrap
msgid "`old`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2926
#, no-wrap
msgid "Existing subject credential"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2929
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5332
#, no-wrap
msgid "`new`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2930
#, no-wrap
msgid "New subject credential to be labeled"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2934
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2968
#, no-wrap
msgid "File to execute"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2945
msgid ""
"Update the label of a newly created subject credential (`new`) from the "
"passed existing subject credential (`old`) based on a label transition "
"caused by executing the passed vnode (`vp`).  This call occurs when a "
"process executes the passed vnode and one of the policies returns a success "
"from the `mpo_execve_will_transition` entry point.  Policies may choose to "
"implement this call simply by invoking `mpo_create_cred` and passing the two "
"subject credentials so as not to implement a transitioning event.  Policies "
"should not leave this entry point unimplemented if they implement "
"`mpo_create_cred`, even if they do not implement "
"`mpo_execve_will_transition`."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2947
#, no-wrap
msgid "`mpo_execve_will_transition`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2953
#, no-wrap
msgid ""
"int mpo_execve_will_transition(struct ucred *old, struct vnode *vp,\n"
"    struct label *vnodelabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2964
#, no-wrap
msgid "Subject credential prior to man:execve[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2978
msgid ""
"Determine whether the policy will want to perform a transition event as a "
"result of the execution of the passed vnode by the passed subject "
"credential.  Return 1 if a transition is required, 0 if not.  Even if a "
"policy returns 0, it should behave correctly in the presence of an "
"unexpected invocation of `mpo_execve_transition`, as that call may happen as "
"a result of another policy requesting a transition."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2980
#, no-wrap
msgid "`mpo_create_proc0`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2985
#, no-wrap
msgid "void mpo_create_proc0(struct ucred *cred);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:2996
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3018
#, no-wrap
msgid "Subject credential to be filled in"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3000
msgid ""
"Create the subject credential of process 0, the parent of all kernel "
"processes."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3002
#, no-wrap
msgid "`mpo_create_proc1`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3007
#, no-wrap
msgid "void mpo_create_proc1(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3022
msgid ""
"Create the subject credential of process 1, the parent of all user processes."
msgstr ""

#. type: Title =====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3024
#, no-wrap
msgid "`mpo_relabel_cred`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3029
#, no-wrap
msgid "void mpo_relabel_cred(struct ucred *cred, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3044
#, no-wrap
msgid "Label update to apply to `cred`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3048
msgid "Update the label on a subject credential from the passed update label."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3050
#, no-wrap
msgid "Access Control Checks"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3058
msgid ""
"Access control entry points permit policy modules to influence access "
"control decisions made by the kernel.  Generally, although not always, "
"arguments to an access control entry point will include one or more "
"authorizing credentials, information (possibly including a label) for any "
"other objects involved in the operation.  An access control entry point may "
"return 0 to permit the operation, or an man:errno[2] error value.  The "
"results of invoking the entry point across various registered policy modules "
"will be composed as follows: if all modules permit the operation to succeed, "
"success will be returned.  If one or modules returns a failure, a failure "
"will be returned.  If more than one module returns a failure, the errno "
"value to return to the user will be selected using the following precedence, "
"implemented by the `error_select()` function in [.filename]#kern_mac.c#:"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3064
#, no-wrap
msgid "Most precedence"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3066
#, no-wrap
msgid "EDEADLK"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3069
#, no-wrap
msgid "EINVAL"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3072
#, no-wrap
msgid "ESRCH"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3075
#, no-wrap
msgid "EACCES"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3076
#, no-wrap
msgid "Least precedence"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3077
#, no-wrap
msgid "EPERM"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3081
msgid ""
"If none of the error values returned by all modules are listed in the "
"precedence chart then an arbitrarily selected value from the set will be "
"returned.  In general, the rules provide precedence to errors in the "
"following order: kernel failures, invalid arguments, object not present, "
"access not permitted, other."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3083
#, no-wrap
msgid "`mpo_check_bpfdesc_receive`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3089
#, no-wrap
msgid ""
"int mpo_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel,\n"
"    struct ifnet *ifnet, struct label *ifnetlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3100
#, no-wrap
msgid "Subject; BPF descriptor"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3104
#, no-wrap
msgid "Policy label for `bpf_d`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3108
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3703
#, no-wrap
msgid "Object; network interface"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3117
msgid ""
"Determine whether the MAC framework should permit datagrams from the passed "
"interface to be delivered to the buffers of the passed BPF descriptor.  "
"Return (0) for success, or an `errno` value for failure Suggested failure: "
"EACCES for label mismatches, EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3119
#, no-wrap
msgid "`mpo_check_kenv_dump`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3124
#, no-wrap
msgid "int mpo_check_kenv_dump(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3139
msgid ""
"Determine whether the subject should be allowed to retrieve the kernel "
"environment (see man:kenv[2])."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3141
#, no-wrap
msgid "`mpo_check_kenv_get`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3146
#, no-wrap
msgid "int mpo_check_kenv_get(struct ucred *cred, char *name);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3160
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3186
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3212
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4208
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4775
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5312
#, no-wrap
msgid "`name`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3161
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3187
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3213
#, no-wrap
msgid "Kernel environment variable name"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3165
msgid ""
"Determine whether the subject should be allowed to retrieve the value of the "
"specified kernel environment variable."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3167
#, no-wrap
msgid "`mpo_check_kenv_set`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3172
#, no-wrap
msgid "int mpo_check_kenv_set(struct ucred *cred, char *name);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3191
msgid ""
"Determine whether the subject should be allowed to set the specified kernel "
"environment variable."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3193
#, no-wrap
msgid "`mpo_check_kenv_unset`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3198
#, no-wrap
msgid "int mpo_check_kenv_unset(struct ucred *cred, char *name);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3217
msgid ""
"Determine whether the subject should be allowed to unset the specified "
"kernel environment variable."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3219
#, no-wrap
msgid "`mpo_check_kld_load`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3225
#, no-wrap
msgid ""
"int mpo_check_kld_load(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3240
#, no-wrap
msgid "Kernel module vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3244
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5185
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5286
#, no-wrap
msgid "Label associated with `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3248
msgid ""
"Determine whether the subject should be allowed to load the specified module "
"file."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3250
#, no-wrap
msgid "`mpo_check_kld_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3255
#, no-wrap
msgid "int mpo_check_kld_stat(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3270
msgid ""
"Determine whether the subject should be allowed to retrieve a list of loaded "
"kernel module files and associated statistics."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3272
#, no-wrap
msgid "`mpo_check_kld_unload`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3277
#, no-wrap
msgid "int mpo_check_kld_unload(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3292
msgid ""
"Determine whether the subject should be allowed to unload a kernel module."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3294
#, no-wrap
msgid "`mpo_check_pipe_ioctl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3300
#, no-wrap
msgid ""
"int mpo_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel, unsigned long cmd, void *data);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3322
#, no-wrap
msgid "`cmd`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3323
#, no-wrap
msgid "man:ioctl[2] command"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3326
#, no-wrap
msgid "`data`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3327
#, no-wrap
msgid "man:ioctl[2] data"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3331
msgid ""
"Determine whether the subject should be allowed to make the specified "
"man:ioctl[2] call."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3333
#, no-wrap
msgid "`mpo_check_pipe_poll`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3339
#, no-wrap
msgid ""
"int mpo_check_pipe_poll(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3362
msgid "Determine whether the subject should be allowed to poll `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3364
#, no-wrap
msgid "`mpo_check_pipe_read`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3370
#, no-wrap
msgid ""
"int mpo_check_pipe_read(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3393
msgid "Determine whether the subject should be allowed read access to `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3395
#, no-wrap
msgid "`mpo_check_pipe_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3401
#, no-wrap
msgid ""
"int mpo_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3424
#, no-wrap
msgid "Label update to `pipelabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3428
msgid "Determine whether the subject should be allowed to relabel `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3430
#, no-wrap
msgid "`mpo_check_pipe_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3436
#, no-wrap
msgid ""
"int mpo_check_pipe_stat(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3459
msgid ""
"Determine whether the subject should be allowed to retrieve statistics "
"related to `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3461
#, no-wrap
msgid "`mpo_check_pipe_write`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3467
#, no-wrap
msgid ""
"int mpo_check_pipe_write(struct ucred *cred, struct pipe *pipe,\n"
"    struct label *pipelabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3490
msgid "Determine whether the subject should be allowed to write to `pipe`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3492
#, no-wrap
msgid "`mpo_check_socket_bind`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3498
#, no-wrap
msgid ""
"int mpo_check_socket_bind(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel, struct sockaddr *sockaddr);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3513
#, no-wrap
msgid "Socket to be bound"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3520
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3553
#, no-wrap
msgid "`sockaddr`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3521
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3554
#, no-wrap
msgid "Address of `socket`"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3525
#, no-wrap
msgid "`mpo_check_socket_connect`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3531
#, no-wrap
msgid ""
"int mpo_check_socket_connect(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel, struct sockaddr *sockaddr);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3546
#, no-wrap
msgid "Socket to be connected"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3560
msgid ""
"Determine whether the subject credential (`cred`) can connect the passed "
"socket (`socket`) to the passed socket address (`sockaddr`).  Return 0 for "
"success, or an `errno` value for failure.  Suggested failure: EACCES for "
"label mismatches, EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3562
#, no-wrap
msgid "`mpo_check_socket_receive`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3568
#, no-wrap
msgid ""
"int mpo_check_socket_receive(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3587
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3618
#, no-wrap
msgid "Policy label associated with `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3591
msgid ""
"Determine whether the subject should be allowed to receive information from "
"the socket `so`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3593
#, no-wrap
msgid "`mpo_check_socket_send`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3599
#, no-wrap
msgid ""
"int mpo_check_socket_send(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3622
msgid ""
"Determine whether the subject should be allowed to send information across "
"the socket `so`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3624
#, no-wrap
msgid "`mpo_check_cred_visible`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3629
#, no-wrap
msgid "int mpo_check_cred_visible(struct ucred *u1, struct ucred *u2);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3639
#, no-wrap
msgid "`u1`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3643
#, no-wrap
msgid "`u2`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3644
#, no-wrap
msgid "Object credential"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3651
msgid ""
"Determine whether the subject credential `u1` can \"see\" other subjects "
"with the passed subject credential `u2`.  Return 0 for success, or an "
"`errno` value for failure.  Suggested failure: EACCES for label mismatches, "
"EPERM for lack of privilege, or ESRCH to hide visibility.  This call may be "
"made in a number of situations, including inter-process status sysctl's used "
"by `ps`, and in procfs lookups."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3653
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5127
#, no-wrap
msgid "`mpo_check_socket_visible`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3659
#, no-wrap
msgid ""
"int mpo_check_socket_visible(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3682
#, no-wrap
msgid "`mpo_check_ifnet_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3688
#, no-wrap
msgid ""
"int mpo_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3707
#, no-wrap
msgid "Existing policy label for `ifnet`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3711
#, no-wrap
msgid "Policy label update to later be applied to `ifnet`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3715
msgid ""
"Determine whether the subject credential can relabel the passed network "
"interface to the passed label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3717
#, no-wrap
msgid "`mpo_check_socket_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3723
#, no-wrap
msgid ""
"int mpo_check_socket_relabel(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3742
#, no-wrap
msgid "Existing policy label for `socket`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3746
#, no-wrap
msgid "Label update to later be applied to `socketlabel`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3750
msgid ""
"Determine whether the subject credential can relabel the passed socket to "
"the passed label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3752
#, no-wrap
msgid "`mpo_check_cred_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3757
#, no-wrap
msgid "int mpo_check_cred_relabel(struct ucred *cred, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3772
#, no-wrap
msgid "Label update to later be applied to `cred`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3776
msgid ""
"Determine whether the subject credential can relabel itself to the passed "
"label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3778
#, no-wrap
msgid "`mpo_check_vnode_relabel`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3784
#, no-wrap
msgid ""
"int mpo_check_vnode_relabel(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vnodelabel, struct label *newlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3799
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3897
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3999
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4089
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4160
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4197
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4549
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4586
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4656
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4690
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4723
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4764
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4812
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4849
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4886
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5031
#, no-wrap
msgid "Object; vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3807
#, no-wrap
msgid "Policy label update to later be applied to `vp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3811
msgid ""
"Determine whether the subject credential can relabel the passed vnode to the "
"passed label update."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3813
#, no-wrap
msgid "`mpo_check_mount_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3819
#, no-wrap
msgid ""
"int mpo_check_mount_stat(struct ucred *cred, struct mount *mp,\n"
"    struct label *mountlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3834
#, no-wrap
msgid "Object; file system mount"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3837
#, no-wrap
msgid "`mountlabel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3838
#, no-wrap
msgid "Policy label for `mp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3845
msgid ""
"Determine whether the subject credential can see the results of a statfs "
"performed on the file system.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatches or EPERM for lack "
"of privilege.  This call may be made in a number of situations, including "
"during invocations of man:statfs[2] and related calls, as well as to "
"determine what file systems to exclude from listings of file systems, such "
"as when man:getfsstat[2] is invoked."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3847
#, no-wrap
msgid "`mpo_check_proc_debug`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3852
#, no-wrap
msgid "int mpo_check_proc_debug(struct ucred *cred, struct proc *proc);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3866
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4967
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4997
#, no-wrap
msgid "`proc`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3867
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4968
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4998
#, no-wrap
msgid "Object; process"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3874
msgid ""
"Determine whether the subject credential can debug the passed process.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, EPERM for lack of privilege, or ESRCH to hide "
"visibility of the target.  This call may be made in a number of situations, "
"including use of the man:ptrace[2] and man:ktrace[2] APIs, as well as for "
"some types of procfs operations."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3876
#, no-wrap
msgid "`mpo_check_vnode_access`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3882
#, no-wrap
msgid ""
"int mpo_check_vnode_access(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int flags);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3904
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4819
#, no-wrap
msgid "`flags`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3905
#, no-wrap
msgid "man:access[2] flags"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3912
msgid ""
"Determine how invocations of man:access[2] and related calls by the subject "
"credential should return when performed on the passed vnode using the passed "
"access flags.  This should generally be implemented using the same semantics "
"used in `mpo_check_vnode_open`.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatches or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3914
#, no-wrap
msgid "`mpo_check_vnode_chdir`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3920
#, no-wrap
msgid ""
"int mpo_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3935
#, no-wrap
msgid "Object; vnode to man:chdir[2] into"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3939
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4003
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4046
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4553
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4627
#, no-wrap
msgid "Policy label for `dvp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3945
msgid ""
"Determine whether the subject credential can change the process working "
"directory to the passed vnode.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3947
#, no-wrap
msgid "`mpo_check_vnode_chroot`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3953
#, no-wrap
msgid ""
"int mpo_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3968
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4244
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4424
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4468
#, no-wrap
msgid "Directory vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3972
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4248
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4428
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4472
#, no-wrap
msgid "Policy label associated with `dvp`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3976
msgid ""
"Determine whether the subject should be allowed to man:chroot[2] into the "
"specified directory (`dvp`)."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3978
#, no-wrap
msgid "`mpo_check_vnode_create`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:3984
#, no-wrap
msgid ""
"int mpo_check_vnode_create(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct componentname *cnp, struct vattr *vap);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4007
#, no-wrap
msgid "Component name for `dvp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4010
#, no-wrap
msgid "`vap`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4011
#, no-wrap
msgid "vnode attributes for `vap`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4018
msgid ""
"Determine whether the subject credential can create a vnode with the passed "
"parent directory, passed name information, and passed attribute "
"information.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege.  This call may be made in a number of situations, including as a "
"result of calls to man:open[2] with O_CREAT, man:mkfifo[2], and others."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4020
#, no-wrap
msgid "`mpo_check_vnode_delete`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4027
#, no-wrap
msgid ""
"int mpo_check_vnode_delete(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, void *label,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4050
#, no-wrap
msgid "Object; vnode to delete"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4066
msgid ""
"Determine whether the subject credential can delete a vnode from the passed "
"parent directory and passed name information.  Return 0 for success, or an "
"`errno` value for failure.  Suggested failure: EACCES for label mismatch, or "
"EPERM for lack of privilege.  This call may be made in a number of "
"situations, including as a result of calls to man:unlink[2] and "
"man:rmdir[2].  Policies implementing this entry point should also implement "
"`mpo_check_rename_to` to authorize deletion of objects as a result of being "
"the target of a rename."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4068
#, no-wrap
msgid "`mpo_check_vnode_deleteacl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4074
#, no-wrap
msgid ""
"int mpo_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, acl_type_t type);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4096
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4167
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4730
#, no-wrap
msgid "`type`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4097
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4168
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4731
#, no-wrap
msgid "ACL type"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4103
msgid ""
"Determine whether the subject credential can delete the ACL of passed type "
"from the passed vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4105
#, no-wrap
msgid "`mpo_check_vnode_exec`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4111
#, no-wrap
msgid ""
"int mpo_check_vnode_exec(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4126
#, no-wrap
msgid "Object; vnode to execute"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4137
msgid ""
"Determine whether the subject credential can execute the passed vnode.  "
"Determination of execute privilege is made separately from decisions about "
"any transitioning event.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4139
#, no-wrap
msgid "`mpo_check_vnode_getacl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4145
#, no-wrap
msgid ""
"int mpo_check_vnode_getacl(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, acl_type_t type);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4174
msgid ""
"Determine whether the subject credential can retrieve the ACL of passed type "
"from the passed vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4176
#, no-wrap
msgid "`mpo_check_vnode_getextattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4182
#, no-wrap
msgid ""
"int mpo_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int attrnamespace, const char *name, struct uio *uio);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4204
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4771
#, no-wrap
msgid "`attrnamespace`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4205
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4772
#, no-wrap
msgid "Extended attribute namespace"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4209
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4776
#, no-wrap
msgid "Extended attribute name"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4212
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4779
#, no-wrap
msgid "`uio`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4213
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4780
#, no-wrap
msgid "I/O structure pointer; see man:uio[9]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4220
msgid ""
"Determine whether the subject credential can retrieve the extended attribute "
"with the passed namespace and name from the passed vnode.  Policies "
"implementing labeling using extended attributes may be interested in special "
"handling of operations on those extended attributes.  Return 0 for success, "
"or an `errno` value for failure.  Suggested failure: EACCES for label "
"mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4222
#, no-wrap
msgid "`mpo_check_vnode_link`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4229
#, no-wrap
msgid ""
"int mpo_check_vnode_link(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, struct label *label,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4252
#, no-wrap
msgid "Link destination vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4260
#, no-wrap
msgid "Component name for the link being created"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4264
msgid ""
"Determine whether the subject should be allowed to create a link to the "
"vnode `vp` with the name specified by `cnp`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4266
#, no-wrap
msgid "`mpo_check_vnode_mmap`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4272
#, no-wrap
msgid ""
"int mpo_check_vnode_mmap(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int prot);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4287
#, no-wrap
msgid "Vnode to map"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4294
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4329
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4360
#, no-wrap
msgid "`prot`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4295
#, no-wrap
msgid "Mmap protections (see man:mmap[2])"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4299
msgid ""
"Determine whether the subject should be allowed to map the vnode `vp` with "
"the protections specified in `prot`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4301
#, no-wrap
msgid "`mpo_check_vnode_mmap_downgrade`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4307
#, no-wrap
msgid ""
"void mpo_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int *prot);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4318
#, no-wrap
msgid "See crossref:mac[mac-mpo-check-vnode-mmap, `mpo_check_vnode_mmap`]."
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4330
#, no-wrap
msgid "Mmap protections to be downgraded"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4334
msgid "Downgrade the mmap protections based on the subject and object labels."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4336
#, no-wrap
msgid "`mpo_check_vnode_mprotect`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4342
#, no-wrap
msgid ""
"int mpo_check_vnode_mprotect(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int prot);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4357
#, no-wrap
msgid "Mapped vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4361
#, no-wrap
msgid "Memory protections"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4365
msgid ""
"Determine whether the subject should be allowed to set the specified memory "
"protections on memory mapped from the vnode `vp`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4367
#, no-wrap
msgid "`mpo_check_vnode_poll`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4373
#, no-wrap
msgid ""
"int mpo_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,\n"
"    struct vnode *vp, struct label *label);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4383
#, no-wrap
msgid "`active_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4387
#, no-wrap
msgid "`file_cred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4388
#, no-wrap
msgid "Credential associated with the struct file"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4392
#, no-wrap
msgid "Polled vnode"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4400
msgid "Determine whether the subject should be allowed to poll the vnode `vp`."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4402
#, no-wrap
msgid "`mpo_check_vnode_rename_from`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4409
#, no-wrap
msgid ""
"int mpo_vnode_rename_from(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, struct label *label,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4432
#, no-wrap
msgid "Vnode to be renamed"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4444
msgid ""
"Determine whether the subject should be allowed to rename the vnode `vp` to "
"something else."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4446
#, no-wrap
msgid "`mpo_check_vnode_rename_to`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4453
#, no-wrap
msgid ""
"int mpo_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct vnode *vp, struct label *label, int samedir,\n"
"    struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4476
#, no-wrap
msgid "Overwritten vnode"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4483
#, no-wrap
msgid "`samedir`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4484
#, no-wrap
msgid "Boolean; `1` if the source and destination directories are the same"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4488
#, no-wrap
msgid "Destination component name"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4493
msgid ""
"Determine whether the subject should be allowed to rename to the vnode `vp`, "
"into the directory `dvp`, or to the name represented by `cnp`.  If there is "
"no existing file to overwrite, `vp` and `label` will be NULL."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4495
#, no-wrap
msgid "`mpo_check_socket_listen`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4501
#, no-wrap
msgid ""
"int mpo_check_socket_listen(struct ucred *cred, struct socket *socket,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4526
msgid ""
"Determine whether the subject credential can listen on the passed socket.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4528
#, no-wrap
msgid "`mpo_check_vnode_lookup`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4534
#, no-wrap
msgid ""
"int mpo_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel, struct componentname *cnp);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4557
#, no-wrap
msgid "Component name being looked up"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4563
msgid ""
"Determine whether the subject credential can perform a lookup in the passed "
"directory vnode for the passed name.  Return 0 for success, or an `errno` "
"value for failure.  Suggested failure: EACCES for label mismatch, or EPERM "
"for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4565
#, no-wrap
msgid "`mpo_check_vnode_open`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4571
#, no-wrap
msgid ""
"int mpo_check_vnode_open(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int acc_mode);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4593
#, no-wrap
msgid "`acc_mode`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4594
#, no-wrap
msgid "man:open[2] access mode"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4600
msgid ""
"Determine whether the subject credential can perform an open operation on "
"the passed vnode with the passed access mode.  Return 0 for success, or an "
"errno value for failure.  Suggested failure: EACCES for label mismatch, or "
"EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4602
#, no-wrap
msgid "`mpo_check_vnode_readdir`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4608
#, no-wrap
msgid ""
"int mpo_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,\n"
"    struct label *dlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4623
#, no-wrap
msgid "Object; directory vnode"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4633
msgid ""
"Determine whether the subject credential can perform a `readdir` operation "
"on the passed directory vnode.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4635
#, no-wrap
msgid "`mpo_check_vnode_readlink`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4641
#, no-wrap
msgid ""
"int mpo_check_vnode_readlink(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4667
msgid ""
"Determine whether the subject credential can perform a `readlink` operation "
"on the passed symlink vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege.  This call may be made in a number of situations, including an "
"explicit `readlink` call by the user process, or as a result of an implicit "
"`readlink` during a name lookup by the process."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4669
#, no-wrap
msgid "`mpo_check_vnode_revoke`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4675
#, no-wrap
msgid ""
"int mpo_check_vnode_revoke(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4700
msgid ""
"Determine whether the subject credential can revoke access to the passed "
"vnode.  Return 0 for success, or an `errno` value for failure.  Suggested "
"failure: EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4702
#, no-wrap
msgid "`mpo_check_vnode_setacl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4708
#, no-wrap
msgid ""
"int mpo_check_vnode_setacl(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, acl_type_t type, struct acl *acl);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4734
#, no-wrap
msgid "`acl`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4735
#, no-wrap
msgid "ACL"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4741
msgid ""
"Determine whether the subject credential can set the passed ACL of passed "
"type on the passed vnode.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4743
#, no-wrap
msgid "`mpo_check_vnode_setextattr`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4749
#, no-wrap
msgid ""
"int mpo_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, int attrnamespace, const char *name, struct uio *uio);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4789
msgid ""
"Determine whether the subject credential can set the extended attribute of "
"passed name and passed namespace on the passed vnode.  Policies implementing "
"security labels backed into extended attributes may want to provide "
"additional protections for those attributes.  Additionally, policies should "
"avoid making decisions based on the data referenced from `uio`, as there is "
"a potential race condition between this check and the actual operation.  The "
"`uio` may also be `NULL` if a delete operation is being performed.  Return 0 "
"for success, or an `errno` value for failure.  Suggested failure: EACCES for "
"label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4791
#, no-wrap
msgid "`mpo_check_vnode_setflags`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4797
#, no-wrap
msgid ""
"int mpo_check_vnode_setflags(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, u_long flags);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4820
#, no-wrap
msgid "File flags; see man:chflags[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4826
msgid ""
"Determine whether the subject credential can set the passed flags on the "
"passed vnode.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4828
#, no-wrap
msgid "`mpo_check_vnode_setmode`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4834
#, no-wrap
msgid ""
"int mpo_check_vnode_setmode(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, mode_t mode);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4856
#, no-wrap
msgid "`mode`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4857
#, no-wrap
msgid "File mode; see man:chmod[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4863
msgid ""
"Determine whether the subject credential can set the passed mode on the "
"passed vnode.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4865
#, no-wrap
msgid "`mpo_check_vnode_setowner`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4871
#, no-wrap
msgid ""
"int mpo_check_vnode_setowner(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, uid_t uid, gid_t gid);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4893
#, no-wrap
msgid "`uid`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4894
#, no-wrap
msgid "User ID"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4897
#, no-wrap
msgid "`gid`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4898
#, no-wrap
msgid "Group ID"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4905
msgid ""
"Determine whether the subject credential can set the passed uid and passed "
"gid as file uid and file gid on the passed vnode.  The IDs may be set to "
"(`-1`) to request no update.  Return 0 for success, or an `errno` value for "
"failure.  Suggested failure: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4907
#, no-wrap
msgid "`mpo_check_vnode_setutimes`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4913
#, no-wrap
msgid ""
"int mpo_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label, struct timespec atime, struct timespec mtime);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4928
#, no-wrap
msgid "Object; vp"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4935
#, no-wrap
msgid "`atime`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4936
#, no-wrap
msgid "Access time; see man:utimes[2]"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4939
#, no-wrap
msgid "`mtime`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4940
#, no-wrap
msgid "Modification time; see man:utimes[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4946
msgid ""
"Determine whether the subject credential can set the passed access "
"timestamps on the passed vnode.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, or EPERM for "
"lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4948
#, no-wrap
msgid "`mpo_check_proc_sched`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4953
#, no-wrap
msgid "int mpo_check_proc_sched(struct ucred *ucred, struct proc *proc);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4974
msgid ""
"Determine whether the subject credential can change the scheduling "
"parameters of the passed process.  Return 0 for success, or an `errno` value "
"for failure.  Suggested failure: EACCES for label mismatch, EPERM for lack "
"of privilege, or ESRCH to limit visibility."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4976
msgid "See man:setpriority[2] for more information."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4978
#, no-wrap
msgid "`mpo_check_proc_signal`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:4983
#, no-wrap
msgid "int mpo_check_proc_signal(struct ucred *cred, struct proc *proc, int signal);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5001
#, no-wrap
msgid "`signal`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5002
#, no-wrap
msgid "Signal; see man:kill[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5008
msgid ""
"Determine whether the subject credential can deliver the passed signal to "
"the passed process.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failure: EACCES for label mismatch, EPERM for lack of privilege, "
"or ESRCH to limit visibility."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5010
#, no-wrap
msgid "`mpo_check_vnode_stat`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5016
#, no-wrap
msgid ""
"int mpo_check_vnode_stat(struct ucred *cred, struct vnode *vp,\n"
"    struct label *label);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5041
msgid ""
"Determine whether the subject credential can `stat` the passed vnode.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5043
msgid "See man:stat[2] for more information."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5045
#, no-wrap
msgid "`mpo_check_ifnet_transmit`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5051
#, no-wrap
msgid ""
"int mpo_check_ifnet_transmit(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5074
#, no-wrap
msgid "Object; mbuf to be sent"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5084
msgid ""
"Determine whether the network interface can transmit the passed mbuf.  "
"Return 0 for success, or an `errno` value for failure.  Suggested failure: "
"EACCES for label mismatch, or EPERM for lack of privilege."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5086
#, no-wrap
msgid "`mpo_check_socket_deliver`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5092
#, no-wrap
msgid ""
"int mpo_check_socket_deliver(struct ucred *cred, struct ifnet *ifnet,\n"
"    struct label *ifnetlabel, struct mbuf *mbuf, struct label *mbuflabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5115
#, no-wrap
msgid "Object; mbuf to be delivered"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5125
msgid ""
"Determine whether the socket may receive the datagram stored in the passed "
"mbuf header.  Return 0 for success, or an `errno` value for failure.  "
"Suggested failures: EACCES for label mismatch, or EPERM for lack of "
"privilege."
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5133
#, no-wrap
msgid ""
"int mpo_check_socket_visible(struct ucred *cred, struct socket *so,\n"
"    struct label *socketlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5152
#, no-wrap
msgid "Policy label for `so`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5158
msgid ""
"Determine whether the subject credential cred can \"see\" the passed socket "
"(`socket`) using system monitoring functions, such as those employed by "
"man:netstat[8] and man:sockstat[1].  Return 0 for success, or an `errno` "
"value for failure.  Suggested failure: EACCES for label mismatches, EPERM "
"for lack of privilege, or ESRCH to hide visibility."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5160
#, no-wrap
msgid "`mpo_check_system_acct`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5166
#, no-wrap
msgid ""
"int mpo_check_system_acct(struct ucred *ucred, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5176
#, no-wrap
msgid "`ucred`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5181
#, no-wrap
msgid "Accounting file; man:acct[5]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5189
msgid ""
"Determine whether the subject should be allowed to enable accounting, based "
"on its label and the label of the accounting log file."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5191
#, no-wrap
msgid "`mpo_check_system_nfsd`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5196
#, no-wrap
msgid "int mpo_check_system_nfsd(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5211
msgid "Determine whether the subject should be allowed to call man:nfssvc[2]."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5213
#, no-wrap
msgid "`mpo_check_system_reboot`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5218
#, no-wrap
msgid "int mpo_check_system_reboot(struct ucred *cred, int howto);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5232
#, no-wrap
msgid "`howto`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5233
#, no-wrap
msgid "`howto` parameter from man:reboot[2]"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5237
msgid ""
"Determine whether the subject should be allowed to reboot the system in the "
"specified manner."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5239
#, no-wrap
msgid "`mpo_check_system_settime`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5244
#, no-wrap
msgid "int mpo_check_system_settime(struct ucred *cred);\n"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5259
msgid "Determine whether the user should be allowed to set the system clock."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5261
#, no-wrap
msgid "`mpo_check_system_swapon`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5267
#, no-wrap
msgid ""
"int mpo_check_system_swapon(struct ucred *cred, struct vnode *vp,\n"
"    struct label *vlabel);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5282
#, no-wrap
msgid "Swap device"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5290
msgid ""
"Determine whether the subject should be allowed to add `vp` as a swap device."
msgstr ""

#. type: Title ====
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5292
#, no-wrap
msgid "`mpo_check_system_sysctl`"
msgstr ""

#. type: delimited block - 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5298
#, no-wrap
msgid ""
"int mpo_check_system_sysctl(struct ucred *cred, int *name, u_int *namelen,\n"
"    void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen);\n"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5313
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5333
#, no-wrap
msgid "See man:sysctl[3]"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5324
#, no-wrap
msgid "`oldlenp`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5328
#, no-wrap
msgid "`inkernel`"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5329
#, no-wrap
msgid "Boolean; `1` if called from kernel"
msgstr ""

#. type: Table
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5336
#, no-wrap
msgid "`newlen`"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5341
msgid ""
"Determine whether the subject should be allowed to make the specified "
"man:sysctl[3] transaction."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5343
#, no-wrap
msgid "Label Management Calls"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5349
msgid ""
"Relabel events occur when a user process has requested that the label on an "
"object be modified.  A two-phase update occurs: first, an access control "
"check will be performed to determine if the update is both valid and "
"permitted, and then the update itself is performed via a separate entry "
"point.  Relabel entry points typically accept the object, object label "
"reference, and an update label submitted by the process.  Memory allocation "
"during relabel is discouraged, as relabel calls are not permitted to fail "
"(failure should be reported earlier in the relabel check)."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5351
#, no-wrap
msgid "Userland Architecture"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5355
msgid ""
"The TrustedBSD MAC Framework includes a number of policy-agnostic elements, "
"including MAC library interfaces for abstractly managing labels, "
"modifications to the system credential management and login libraries to "
"support the assignment of MAC labels to users, and a set of tools to monitor "
"and modify labels on processes, files, and network interfaces.  More details "
"on the user architecture will be added to this section in the near future."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5357
#, no-wrap
msgid "APIs for Policy-Agnostic Label Management"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5364
msgid ""
"The TrustedBSD MAC Framework provides a number of library and system calls "
"permitting applications to manage MAC labels on objects using a policy-"
"agnostic interface.  This permits applications to manipulate labels for a "
"variety of policies without being written to support specific policies.  "
"These interfaces are used by general-purpose tools such as man:ifconfig[8], "
"man:ls[1] and man:ps[1] to view labels on network interfaces, files, and "
"processes.  The APIs also support MAC management tools including "
"man:getfmac[8], man:getpmac[8], man:setfmac[8], man:setfsmac[8], and "
"man:setpmac[8].  The MAC APIs are documented in man:mac[3]."
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5372
msgid ""
"Applications handle MAC labels in two forms: an internalized form used to "
"return and set labels on processes and objects (`mac_t`), and externalized "
"form based on C strings appropriate for storage in configuration files, "
"display to the user, or input from the user.  Each MAC label contains a "
"number of elements, each consisting of a name and value pair.  Policy "
"modules in the kernel bind to specific names and interpret the values in "
"policy-specific ways.  In the externalized string form, labels are "
"represented by a comma-delimited list of name and value pairs separated by "
"the `/` character.  Labels may be directly converted to and from text using "
"provided APIs; when retrieving labels from the kernel, internalized label "
"storage must first be prepared for the desired label element set.  "
"Typically, this is done in one of two ways: using man:mac_prepare[3] and an "
"arbitrary list of desired label elements, or one of the variants of the call "
"that loads a default element set from the man:mac.conf[5] configuration "
"file.  Per-object defaults permit application writers to usefully display "
"labels associated with objects without being aware of the policies present "
"in the system."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5377
msgid ""
"Currently, direct manipulation of label elements other than by conversion to "
"a text string, string editing, and conversion back to an internalized label "
"is not supported by the MAC library.  Such interfaces may be added in the "
"future if they prove necessary for application writers."
msgstr ""

#. type: Title ===
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5380
#, no-wrap
msgid "Binding of Labels to Users"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5384
msgid ""
"The standard user context management interface, man:setusercontext[3], has "
"been modified to retrieve MAC labels associated with a user's class from "
"man:login.conf[5].  These labels are then set along with other user context "
"when either `LOGIN_SETALL` is specified, or when `LOGIN_SETMAC` is "
"explicitly specified."
msgstr ""

#. type: delimited block = 4
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5389
msgid ""
"It is expected that, in a future version of FreeBSD, the MAC label database "
"will be separated from the [.filename]#login.conf# user class abstraction, "
"and be maintained in a separate database.  However, the "
"man:setusercontext[3] API should remain the same following such a change."
msgstr ""

#. type: Title ==
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5392
#, no-wrap
msgid "Conclusion"
msgstr ""

#. type: Plain text
#: documentation/content/en/books/arch-handbook/mac/_index.adoc:5397
msgid ""
"The TrustedBSD MAC framework permits kernel modules to augment the system "
"security policy in a highly integrated manner.  They may do this based on "
"existing object properties, or based on label data that is maintained with "
"the assistance of the MAC framework.  The framework is sufficiently flexible "
"to implement a variety of policy types, including information flow security "
"policies such as MLS and Biba, as well as policies based on existing BSD "
"credentials or file protections.  Policy authors may wish to consult this "
"documentation as well as existing security modules when implementing a new "
"security service."
msgstr ""