11 files changed, 2656 insertions, 2712 deletions

diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c
index 5a87aeed4626..ae25926d0a6e 100644
--- a/sys/security/mac_biba/mac_biba.c
+++ b/sys/security/mac_biba/mac_biba.c
@@ -88,14 +88,14 @@ SYSCTL_DECL(_security_mac);
 SYSCTL_NODE(_security_mac, OID_AUTO, biba, CTLFLAG_RW, 0,
     "TrustedBSD mac_biba policy controls");
 
-static int	mac_biba_label_size = sizeof(struct mac_biba);
+static int	biba_label_size = sizeof(struct mac_biba);
 SYSCTL_INT(_security_mac_biba, OID_AUTO, label_size, CTLFLAG_RD,
-    &mac_biba_label_size, 0, "Size of struct mac_biba");
+    &biba_label_size, 0, "Size of struct mac_biba");
 
-static int	mac_biba_enabled = 1;
-SYSCTL_INT(_security_mac_biba, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_biba_enabled, 0, "Enforce MAC/Biba policy");
-TUNABLE_INT("security.mac.biba.enabled", &mac_biba_enabled);
+static int	biba_enabled = 1;
+SYSCTL_INT(_security_mac_biba, OID_AUTO, enabled, CTLFLAG_RW, &biba_enabled,
+    0, "Enforce MAC/Biba policy");
+TUNABLE_INT("security.mac.biba.enabled", &biba_enabled);
 
 static int	destroyed_not_inited;
 SYSCTL_INT(_security_mac_biba, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
@@ -117,8 +117,8 @@ SYSCTL_INT(_security_mac_biba, OID_AUTO, max_compartments, CTLFLAG_RD,
     &max_compartments, 0, "Maximum supported compartments");
 
 static int	ptys_equal = 0;
-SYSCTL_INT(_security_mac_biba, OID_AUTO, ptys_equal, CTLFLAG_RW,
-    &ptys_equal, 0, "Label pty devices as biba/equal on create");
+SYSCTL_INT(_security_mac_biba, OID_AUTO, ptys_equal, CTLFLAG_RW, &ptys_equal,
+    0, "Label pty devices as biba/equal on create");
 TUNABLE_INT("security.mac.biba.ptys_equal", &ptys_equal);
 
 static int	interfaces_equal;
@@ -131,9 +131,9 @@ SYSCTL_INT(_security_mac_biba, OID_AUTO, revocation_enabled, CTLFLAG_RW,
     &revocation_enabled, 0, "Revoke access to objects on relabel");
 TUNABLE_INT("security.mac.biba.revocation_enabled", &revocation_enabled);
 
-static int	mac_biba_slot;
-#define	SLOT(l)	((struct mac_biba *)mac_label_get((l), mac_biba_slot))
-#define	SLOT_SET(l, val) mac_label_set((l), mac_biba_slot, (uintptr_t)(val))
+static int	biba_slot;
+#define	SLOT(l)	((struct mac_biba *)mac_label_get((l), biba_slot))
+#define	SLOT_SET(l, val) mac_label_set((l), biba_slot, (uintptr_t)(val))
 
 static uma_zone_t	zone_biba;
 
@@ -155,27 +155,26 @@ biba_alloc(int flag)
 }
 
 static void
-biba_free(struct mac_biba *mac_biba)
+biba_free(struct mac_biba *mb)
 {
 
-	if (mac_biba != NULL)
-		uma_zfree(zone_biba, mac_biba);
+	if (mb != NULL)
+		uma_zfree(zone_biba, mb);
 	else
 		atomic_add_int(&destroyed_not_inited, 1);
 }
 
 static int
-biba_atmostflags(struct mac_biba *mac_biba, int flags)
+biba_atmostflags(struct mac_biba *mb, int flags)
 {
 
-	if ((mac_biba->mb_flags & flags) != mac_biba->mb_flags)
+	if ((mb->mb_flags & flags) != mb->mb_flags)
 		return (EINVAL);
 	return (0);
 }
 
 static int
-mac_biba_dominate_element(struct mac_biba_element *a,
-    struct mac_biba_element *b)
+biba_dominate_element(struct mac_biba_element *a, struct mac_biba_element *b)
 {
 	int bit;
 
@@ -195,7 +194,7 @@ mac_biba_dominate_element(struct mac_biba_element *a,
 			return (1);
 
 		default:
-			panic("mac_biba_dominate_element: b->mbe_type invalid");
+			panic("biba_dominate_element: b->mbe_type invalid");
 		}
 
 	case MAC_BIBA_TYPE_GRADE:
@@ -216,70 +215,69 @@ mac_biba_dominate_element(struct mac_biba_element *a,
 			return (a->mbe_grade >= b->mbe_grade);
 
 		default:
-			panic("mac_biba_dominate_element: b->mbe_type invalid");
+			panic("biba_dominate_element: b->mbe_type invalid");
 		}
 
 	default:
-		panic("mac_biba_dominate_element: a->mbe_type invalid");
+		panic("biba_dominate_element: a->mbe_type invalid");
 	}
 
 	return (0);
 }
 
 static int
-mac_biba_subject_dominate_high(struct mac_biba *mac_biba)
+biba_subject_dominate_high(struct mac_biba *mb)
 {
 	struct mac_biba_element *element;
 
-	KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_effective_in_range: mac_biba not effective"));
-	element = &mac_biba->mb_effective;
+	KASSERT((mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
+	    ("biba_effective_in_range: mb not effective"));
+	element = &mb->mb_effective;
 
 	return (element->mbe_type == MAC_BIBA_TYPE_EQUAL ||
 	    element->mbe_type == MAC_BIBA_TYPE_HIGH);
 }
 
 static int
-mac_biba_range_in_range(struct mac_biba *rangea, struct mac_biba *rangeb)
+biba_range_in_range(struct mac_biba *rangea, struct mac_biba *rangeb)
 {
 
-	return (mac_biba_dominate_element(&rangeb->mb_rangehigh,
+	return (biba_dominate_element(&rangeb->mb_rangehigh,
 	    &rangea->mb_rangehigh) &&
-	    mac_biba_dominate_element(&rangea->mb_rangelow,
+	    biba_dominate_element(&rangea->mb_rangelow,
 	    &rangeb->mb_rangelow));
 }
 
 static int
-mac_biba_effective_in_range(struct mac_biba *effective,
-    struct mac_biba *range)
+biba_effective_in_range(struct mac_biba *effective, struct mac_biba *range)
 {
 
 	KASSERT((effective->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_effective_in_range: a not effective"));
+	    ("biba_effective_in_range: a not effective"));
 	KASSERT((range->mb_flags & MAC_BIBA_FLAG_RANGE) != 0,
-	    ("mac_biba_effective_in_range: b not range"));
+	    ("biba_effective_in_range: b not range"));
 
-	return (mac_biba_dominate_element(&range->mb_rangehigh,
+	return (biba_dominate_element(&range->mb_rangehigh,
 	    &effective->mb_effective) &&
-	    mac_biba_dominate_element(&effective->mb_effective,
+	    biba_dominate_element(&effective->mb_effective,
 	    &range->mb_rangelow));
 
 	return (1);
 }
 
 static int
-mac_biba_dominate_effective(struct mac_biba *a, struct mac_biba *b)
+biba_dominate_effective(struct mac_biba *a, struct mac_biba *b)
 {
 	KASSERT((a->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_dominate_effective: a not effective"));
+	    ("biba_dominate_effective: a not effective"));
 	KASSERT((b->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_dominate_effective: b not effective"));
+	    ("biba_dominate_effective: b not effective"));
 
-	return (mac_biba_dominate_element(&a->mb_effective, &b->mb_effective));
+	return (biba_dominate_element(&a->mb_effective, &b->mb_effective));
 }
 
 static int
-mac_biba_equal_element(struct mac_biba_element *a, struct mac_biba_element *b)
+biba_equal_element(struct mac_biba_element *a, struct mac_biba_element *b)
 {
 
 	if (a->mbe_type == MAC_BIBA_TYPE_EQUAL ||
@@ -290,29 +288,30 @@ mac_biba_equal_element(struct mac_biba_element *a, struct mac_biba_element *b)
 }
 
 static int
-mac_biba_equal_effective(struct mac_biba *a, struct mac_biba *b)
+biba_equal_effective(struct mac_biba *a, struct mac_biba *b)
 {
 
 	KASSERT((a->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_equal_effective: a not effective"));
+	    ("biba_equal_effective: a not effective"));
 	KASSERT((b->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_equal_effective: b not effective"));
+	    ("biba_equal_effective: b not effective"));
 
-	return (mac_biba_equal_element(&a->mb_effective, &b->mb_effective));
+	return (biba_equal_element(&a->mb_effective, &b->mb_effective));
 }
 
 static int
-mac_biba_contains_equal(struct mac_biba *mac_biba)
+biba_contains_equal(struct mac_biba *mb)
 {
 
-	if (mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE)
-		if (mac_biba->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL)
+	if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
+		if (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL)
 			return (1);
+	}
 
-	if (mac_biba->mb_flags & MAC_BIBA_FLAG_RANGE) {
-		if (mac_biba->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL)
+	if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) {
+		if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL)
 			return (1);
-		if (mac_biba->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL)
+		if (mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL)
 			return (1);
 	}
 
@@ -320,25 +319,24 @@ mac_biba_contains_equal(struct mac_biba *mac_biba)
 }
 
 static int
-mac_biba_subject_privileged(struct mac_biba *mac_biba)
+biba_subject_privileged(struct mac_biba *mb)
 {
 
-	KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAGS_BOTH) ==
-	    MAC_BIBA_FLAGS_BOTH,
-	    ("mac_biba_subject_privileged: subject doesn't have both labels"));
+	KASSERT((mb->mb_flags & MAC_BIBA_FLAGS_BOTH) == MAC_BIBA_FLAGS_BOTH,
+	    ("biba_subject_privileged: subject doesn't have both labels"));
 
 	/* If the effective is EQUAL, it's ok. */
-	if (mac_biba->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL)
+	if (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_EQUAL)
 		return (0);
 
 	/* If either range endpoint is EQUAL, it's ok. */
-	if (mac_biba->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL ||
-	    mac_biba->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL)
+	if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_EQUAL ||
+	    mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_EQUAL)
 		return (0);
 
 	/* If the range is low-high, it's ok. */
-	if (mac_biba->mb_rangelow.mbe_type == MAC_BIBA_TYPE_LOW &&
-	    mac_biba->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_HIGH)
+	if (mb->mb_rangelow.mbe_type == MAC_BIBA_TYPE_LOW &&
+	    mb->mb_rangehigh.mbe_type == MAC_BIBA_TYPE_HIGH)
 		return (0);
 
 	/* It's not ok. */
@@ -346,30 +344,30 @@ mac_biba_subject_privileged(struct mac_biba *mac_biba)
 }
 
 static int
-mac_biba_high_effective(struct mac_biba *mac_biba)
+biba_high_effective(struct mac_biba *mb)
 {
 
-	KASSERT((mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_equal_effective: mac_biba not effective"));
+	KASSERT((mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
+	    ("biba_equal_effective: mac_biba not effective"));
 
-	return (mac_biba->mb_effective.mbe_type == MAC_BIBA_TYPE_HIGH);
+	return (mb->mb_effective.mbe_type == MAC_BIBA_TYPE_HIGH);
 }
 
 static int
-mac_biba_valid(struct mac_biba *mac_biba)
+biba_valid(struct mac_biba *mb)
 {
 
-	if (mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
-		switch (mac_biba->mb_effective.mbe_type) {
+	if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
+		switch (mb->mb_effective.mbe_type) {
 		case MAC_BIBA_TYPE_GRADE:
 			break;
 
 		case MAC_BIBA_TYPE_EQUAL:
 		case MAC_BIBA_TYPE_HIGH:
 		case MAC_BIBA_TYPE_LOW:
-			if (mac_biba->mb_effective.mbe_grade != 0 ||
+			if (mb->mb_effective.mbe_grade != 0 ||
 			    !MAC_BIBA_BIT_SET_EMPTY(
-			    mac_biba->mb_effective.mbe_compartments))
+			    mb->mb_effective.mbe_compartments))
 				return (EINVAL);
 			break;
 
@@ -377,21 +375,21 @@ mac_biba_valid(struct mac_biba *mac_biba)
 			return (EINVAL);
 		}
 	} else {
-		if (mac_biba->mb_effective.mbe_type != MAC_BIBA_TYPE_UNDEF)
+		if (mb->mb_effective.mbe_type != MAC_BIBA_TYPE_UNDEF)
 			return (EINVAL);
 	}
 
-	if (mac_biba->mb_flags & MAC_BIBA_FLAG_RANGE) {
-		switch (mac_biba->mb_rangelow.mbe_type) {
+	if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) {
+		switch (mb->mb_rangelow.mbe_type) {
 		case MAC_BIBA_TYPE_GRADE:
 			break;
 
 		case MAC_BIBA_TYPE_EQUAL:
 		case MAC_BIBA_TYPE_HIGH:
 		case MAC_BIBA_TYPE_LOW:
-			if (mac_biba->mb_rangelow.mbe_grade != 0 ||
+			if (mb->mb_rangelow.mbe_grade != 0 ||
 			    !MAC_BIBA_BIT_SET_EMPTY(
-			    mac_biba->mb_rangelow.mbe_compartments))
+			    mb->mb_rangelow.mbe_compartments))
 				return (EINVAL);
 			break;
 
@@ -399,28 +397,28 @@ mac_biba_valid(struct mac_biba *mac_biba)
 			return (EINVAL);
 		}
 
-		switch (mac_biba->mb_rangehigh.mbe_type) {
+		switch (mb->mb_rangehigh.mbe_type) {
 		case MAC_BIBA_TYPE_GRADE:
 			break;
 
 		case MAC_BIBA_TYPE_EQUAL:
 		case MAC_BIBA_TYPE_HIGH:
 		case MAC_BIBA_TYPE_LOW:
-			if (mac_biba->mb_rangehigh.mbe_grade != 0 ||
+			if (mb->mb_rangehigh.mbe_grade != 0 ||
 			    !MAC_BIBA_BIT_SET_EMPTY(
-			    mac_biba->mb_rangehigh.mbe_compartments))
+			    mb->mb_rangehigh.mbe_compartments))
 				return (EINVAL);
 			break;
 
 		default:
 			return (EINVAL);
 		}
-		if (!mac_biba_dominate_element(&mac_biba->mb_rangehigh,
-		    &mac_biba->mb_rangelow))
+		if (!biba_dominate_element(&mb->mb_rangehigh,
+		    &mb->mb_rangelow))
 			return (EINVAL);
 	} else {
-		if (mac_biba->mb_rangelow.mbe_type != MAC_BIBA_TYPE_UNDEF ||
-		    mac_biba->mb_rangehigh.mbe_type != MAC_BIBA_TYPE_UNDEF)
+		if (mb->mb_rangelow.mbe_type != MAC_BIBA_TYPE_UNDEF ||
+		    mb->mb_rangehigh.mbe_type != MAC_BIBA_TYPE_UNDEF)
 			return (EINVAL);
 	}
 
@@ -428,45 +426,43 @@ mac_biba_valid(struct mac_biba *mac_biba)
 }
 
 static void
-mac_biba_set_range(struct mac_biba *mac_biba, u_short typelow,
-    u_short gradelow, u_char *compartmentslow, u_short typehigh,
-    u_short gradehigh, u_char *compartmentshigh)
+biba_set_range(struct mac_biba *mb, u_short typelow, u_short gradelow,
+    u_char *compartmentslow, u_short typehigh, u_short gradehigh,
+    u_char *compartmentshigh)
 {
 
-	mac_biba->mb_rangelow.mbe_type = typelow;
-	mac_biba->mb_rangelow.mbe_grade = gradelow;
+	mb->mb_rangelow.mbe_type = typelow;
+	mb->mb_rangelow.mbe_grade = gradelow;
 	if (compartmentslow != NULL)
-		memcpy(mac_biba->mb_rangelow.mbe_compartments,
-		    compartmentslow,
-		    sizeof(mac_biba->mb_rangelow.mbe_compartments));
-	mac_biba->mb_rangehigh.mbe_type = typehigh;
-	mac_biba->mb_rangehigh.mbe_grade = gradehigh;
+		memcpy(mb->mb_rangelow.mbe_compartments, compartmentslow,
+		    sizeof(mb->mb_rangelow.mbe_compartments));
+	mb->mb_rangehigh.mbe_type = typehigh;
+	mb->mb_rangehigh.mbe_grade = gradehigh;
 	if (compartmentshigh != NULL)
-		memcpy(mac_biba->mb_rangehigh.mbe_compartments,
-		    compartmentshigh,
-		    sizeof(mac_biba->mb_rangehigh.mbe_compartments));
-	mac_biba->mb_flags |= MAC_BIBA_FLAG_RANGE;
+		memcpy(mb->mb_rangehigh.mbe_compartments, compartmentshigh,
+		    sizeof(mb->mb_rangehigh.mbe_compartments));
+	mb->mb_flags |= MAC_BIBA_FLAG_RANGE;
 }
 
 static void
-mac_biba_set_effective(struct mac_biba *mac_biba, u_short type, u_short grade,
+biba_set_effective(struct mac_biba *mb, u_short type, u_short grade,
     u_char *compartments)
 {
 
-	mac_biba->mb_effective.mbe_type = type;
-	mac_biba->mb_effective.mbe_grade = grade;
+	mb->mb_effective.mbe_type = type;
+	mb->mb_effective.mbe_grade = grade;
 	if (compartments != NULL)
-		memcpy(mac_biba->mb_effective.mbe_compartments, compartments,
-		    sizeof(mac_biba->mb_effective.mbe_compartments));
-	mac_biba->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
+		memcpy(mb->mb_effective.mbe_compartments, compartments,
+		    sizeof(mb->mb_effective.mbe_compartments));
+	mb->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
 }
 
 static void
-mac_biba_copy_range(struct mac_biba *labelfrom, struct mac_biba *labelto)
+biba_copy_range(struct mac_biba *labelfrom, struct mac_biba *labelto)
 {
 
 	KASSERT((labelfrom->mb_flags & MAC_BIBA_FLAG_RANGE) != 0,
-	    ("mac_biba_copy_range: labelfrom not range"));
+	    ("biba_copy_range: labelfrom not range"));
 
 	labelto->mb_rangelow = labelfrom->mb_rangelow;
 	labelto->mb_rangehigh = labelfrom->mb_rangehigh;
@@ -474,31 +470,31 @@ mac_biba_copy_range(struct mac_biba *labelfrom, struct mac_biba *labelto)
 }
 
 static void
-mac_biba_copy_effective(struct mac_biba *labelfrom, struct mac_biba *labelto)
+biba_copy_effective(struct mac_biba *labelfrom, struct mac_biba *labelto)
 {
 
 	KASSERT((labelfrom->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) != 0,
-	    ("mac_biba_copy_effective: labelfrom not effective"));
+	    ("biba_copy_effective: labelfrom not effective"));
 
 	labelto->mb_effective = labelfrom->mb_effective;
 	labelto->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
 }
 
 static void
-mac_biba_copy(struct mac_biba *source, struct mac_biba *dest)
+biba_copy(struct mac_biba *source, struct mac_biba *dest)
 {
 
 	if (source->mb_flags & MAC_BIBA_FLAG_EFFECTIVE)
-		mac_biba_copy_effective(source, dest);
+		biba_copy_effective(source, dest);
 	if (source->mb_flags & MAC_BIBA_FLAG_RANGE)
-		mac_biba_copy_range(source, dest);
+		biba_copy_range(source, dest);
 }
 
 /*
  * Policy module operations.
  */
 static void
-mac_biba_init(struct mac_policy_conf *conf)
+biba_init(struct mac_policy_conf *conf)
 {
 
 	zone_biba = uma_zcreate("mac_biba", sizeof(struct mac_biba), NULL,
@@ -509,14 +505,14 @@ mac_biba_init(struct mac_policy_conf *conf)
  * Label operations.
  */
 static void
-mac_biba_init_label(struct label *label)
+biba_init_label(struct label *label)
 {
 
 	SLOT_SET(label, biba_alloc(M_WAITOK));
 }
 
 static int
-mac_biba_init_label_waitcheck(struct label *label, int flag)
+biba_init_label_waitcheck(struct label *label, int flag)
 {
 
 	SLOT_SET(label, biba_alloc(flag));
@@ -527,7 +523,7 @@ mac_biba_init_label_waitcheck(struct label *label, int flag)
 }
 
 static void
-mac_biba_destroy_label(struct label *label)
+biba_destroy_label(struct label *label)
 {
 
 	biba_free(SLOT(label));
@@ -535,12 +531,12 @@ mac_biba_destroy_label(struct label *label)
 }
 
 /*
- * mac_biba_element_to_string() accepts an sbuf and Biba element.  It
- * converts the Biba element to a string and stores the result in the
- * sbuf; if there isn't space in the sbuf, -1 is returned.
+ * biba_element_to_string() accepts an sbuf and Biba element.  It converts
+ * the Biba element to a string and stores the result in the sbuf; if there
+ * isn't space in the sbuf, -1 is returned.
  */
 static int
-mac_biba_element_to_string(struct sbuf *sb, struct mac_biba_element *element)
+biba_element_to_string(struct sbuf *sb, struct mac_biba_element *element)
 {
 	int i, first;
 
@@ -576,41 +572,38 @@ mac_biba_element_to_string(struct sbuf *sb, struct mac_biba_element *element)
 		return (0);
 
 	default:
-		panic("mac_biba_element_to_string: invalid type (%d)",
+		panic("biba_element_to_string: invalid type (%d)",
 		    element->mbe_type);
 	}
 }
 
 /*
- * mac_biba_to_string() converts a Biba label to a string, and places
- * the results in the passed sbuf.  It returns 0 on success, or EINVAL
- * if there isn't room in the sbuf.  Note: the sbuf will be modified
- * even in a failure case, so the caller may need to revert the sbuf
- * by restoring the offset if that's undesired.
+ * biba_to_string() converts a Biba label to a string, and places the results
+ * in the passed sbuf.  It returns 0 on success, or EINVAL if there isn't
+ * room in the sbuf.  Note: the sbuf will be modified even in a failure case,
+ * so the caller may need to revert the sbuf by restoring the offset if
+ * that's undesired.
  */
 static int
-mac_biba_to_string(struct sbuf *sb, struct mac_biba *mac_biba)
+biba_to_string(struct sbuf *sb, struct mac_biba *mb)
 {
 
-	if (mac_biba->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
-		if (mac_biba_element_to_string(sb, &mac_biba->mb_effective)
-		    == -1)
+	if (mb->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) {
+		if (biba_element_to_string(sb, &mb->mb_effective) == -1)
 			return (EINVAL);
 	}
 
-	if (mac_biba->mb_flags & MAC_BIBA_FLAG_RANGE) {
+	if (mb->mb_flags & MAC_BIBA_FLAG_RANGE) {
 		if (sbuf_putc(sb, '(') == -1)
 			return (EINVAL);
 
-		if (mac_biba_element_to_string(sb, &mac_biba->mb_rangelow)
-		    == -1)
+		if (biba_element_to_string(sb, &mb->mb_rangelow) == -1)
 			return (EINVAL);
 
 		if (sbuf_putc(sb, '-') == -1)
 			return (EINVAL);
 
-		if (mac_biba_element_to_string(sb, &mac_biba->mb_rangehigh)
-		    == -1)
+		if (biba_element_to_string(sb, &mb->mb_rangehigh) == -1)
 			return (EINVAL);
 
 		if (sbuf_putc(sb, ')') == -1)
@@ -621,32 +614,30 @@ mac_biba_to_string(struct sbuf *sb, struct mac_biba *mac_biba)
 }
 
 static int
-mac_biba_externalize_label(struct label *label, char *element_name,
+biba_externalize_label(struct label *label, char *element_name,
     struct sbuf *sb, int *claimed)
 {
-	struct mac_biba *mac_biba;
+	struct mac_biba *mb;
 
 	if (strcmp(MAC_BIBA_LABEL_NAME, element_name) != 0)
 		return (0);
 
 	(*claimed)++;
 
-	mac_biba = SLOT(label);
-	return (mac_biba_to_string(sb, mac_biba));
+	mb = SLOT(label);
+	return (biba_to_string(sb, mb));
 }
 
 static int
-mac_biba_parse_element(struct mac_biba_element *element, char *string)
+biba_parse_element(struct mac_biba_element *element, char *string)
 {
 	char *compartment, *end, *grade;
 	int value;
 
-	if (strcmp(string, "high") == 0 ||
-	    strcmp(string, "hi") == 0) {
+	if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
 		element->mbe_type = MAC_BIBA_TYPE_HIGH;
 		element->mbe_grade = MAC_BIBA_TYPE_UNDEF;
-	} else if (strcmp(string, "low") == 0 ||
-	    strcmp(string, "lo") == 0) {
+	} else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
 		element->mbe_type = MAC_BIBA_TYPE_LOW;
 		element->mbe_grade = MAC_BIBA_TYPE_UNDEF;
 	} else if (strcmp(string, "equal") == 0 ||
@@ -668,9 +659,8 @@ mac_biba_parse_element(struct mac_biba_element *element, char *string)
 		element->mbe_grade = value;
 
 		/*
-		 * Optional compartment piece of the element.  If none
-		 * are included, we assume that the label has no
-		 * compartments.
+		 * Optional compartment piece of the element.  If none are
+		 * included, we assume that the label has no compartments.
 		 */
 		if (string == NULL)
 			return (0);
@@ -691,11 +681,11 @@ mac_biba_parse_element(struct mac_biba_element *element, char *string)
 }
 
 /*
- * Note: destructively consumes the string, make a local copy before
- * calling if that's a problem.
+ * Note: destructively consumes the string, make a local copy before calling
+ * if that's a problem.
  */
 static int
-mac_biba_parse(struct mac_biba *mac_biba, char *string)
+biba_parse(struct mac_biba *mb, char *string)
 {
 	char *rangehigh, *rangelow, *effective;
 	int error;
@@ -720,29 +710,27 @@ mac_biba_parse(struct mac_biba *mac_biba, char *string)
 
 	KASSERT((rangelow != NULL && rangehigh != NULL) ||
 	    (rangelow == NULL && rangehigh == NULL),
-	    ("mac_biba_parse: range mismatch"));
+	    ("biba_parse: range mismatch"));
 
-	bzero(mac_biba, sizeof(*mac_biba));
+	bzero(mb, sizeof(*mb));
 	if (effective != NULL) {
-		error = mac_biba_parse_element(&mac_biba->mb_effective, effective);
+		error = biba_parse_element(&mb->mb_effective, effective);
 		if (error)
 			return (error);
-		mac_biba->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
+		mb->mb_flags |= MAC_BIBA_FLAG_EFFECTIVE;
 	}
 
 	if (rangelow != NULL) {
-		error = mac_biba_parse_element(&mac_biba->mb_rangelow,
-		    rangelow);
+		error = biba_parse_element(&mb->mb_rangelow, rangelow);
 		if (error)
 			return (error);
-		error = mac_biba_parse_element(&mac_biba->mb_rangehigh,
-		    rangehigh);
+		error = biba_parse_element(&mb->mb_rangehigh, rangehigh);
 		if (error)
 			return (error);
-		mac_biba->mb_flags |= MAC_BIBA_FLAG_RANGE;
+		mb->mb_flags |= MAC_BIBA_FLAG_RANGE;
 	}
 
-	error = mac_biba_valid(mac_biba);
+	error = biba_valid(mb);
 	if (error)
 		return (error);
 
@@ -750,10 +738,10 @@ mac_biba_parse(struct mac_biba *mac_biba, char *string)
 }
 
 static int
-mac_biba_internalize_label(struct label *label, char *element_name,
+biba_internalize_label(struct label *label, char *element_name,
     char *element_data, int *claimed)
 {
-	struct mac_biba *mac_biba, mac_biba_temp;
+	struct mac_biba *mb, mb_temp;
 	int error;
 
 	if (strcmp(MAC_BIBA_LABEL_NAME, element_name) != 0)
@@ -761,37 +749,37 @@ mac_biba_internalize_label(struct label *label, char *element_name,
 
 	(*claimed)++;
 
-	error = mac_biba_parse(&mac_biba_temp, element_data);
+	error = biba_parse(&mb_temp, element_data);
 	if (error)
 		return (error);
 
-	mac_biba = SLOT(label);
-	*mac_biba = mac_biba_temp;
+	mb = SLOT(label);
+	*mb = mb_temp;
 
 	return (0);
 }
 
 static void
-mac_biba_copy_label(struct label *src, struct label *dest)
+biba_copy_label(struct label *src, struct label *dest)
 {
 
 	*SLOT(dest) = *SLOT(src);
 }
 
 /*
- * Labeling event operations: file system objects, and things that look
- * a lot like file system objects.
+ * Labeling event operations: file system objects, and things that look a lot
+ * like file system objects.
  */
 static void
-mac_biba_create_devfs_device(struct ucred *cred, struct mount *mp,
+biba_create_devfs_device(struct ucred *cred, struct mount *mp,
     struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
 {
-	struct mac_biba *mac_biba;
+	struct mac_biba *mb;
 	int biba_type;
 
-	mac_biba = SLOT(delabel);
+	mb = SLOT(delabel);
 	if (strcmp(dev->si_name, "null") == 0 ||
-	    strcmp(dev->si_name, "zero") == 0 ||
+	    strcmp(dev->si_name, "zero")== 0 ||
 	    strcmp(dev->si_name, "random") == 0 ||
 	    strncmp(dev->si_name, "fd/", strlen("fd/")) == 0)
 		biba_type = MAC_BIBA_TYPE_EQUAL;
@@ -801,21 +789,21 @@ mac_biba_create_devfs_device(struct ucred *cred, struct mount *mp,
 		biba_type = MAC_BIBA_TYPE_EQUAL;
 	else
 		biba_type = MAC_BIBA_TYPE_HIGH;
-	mac_biba_set_effective(mac_biba, biba_type, 0, NULL);
+	biba_set_effective(mb, biba_type, 0, NULL);
 }
 
 static void
-mac_biba_create_devfs_directory(struct mount *mp, char *dirname,
+biba_create_devfs_directory(struct mount *mp, char *dirname,
     int dirnamelen, struct devfs_dirent *de, struct label *delabel)
 {
-	struct mac_biba *mac_biba;
+	struct mac_biba *mb;
 
-	mac_biba = SLOT(delabel);
-	mac_biba_set_effective(mac_biba, MAC_BIBA_TYPE_HIGH, 0, NULL);
+	mb = SLOT(delabel);
+	biba_set_effective(mb, MAC_BIBA_TYPE_HIGH, 0, NULL);
 }
 
 static void
-mac_biba_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+biba_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
     struct label *delabel)
 {
@@ -824,22 +812,23 @@ mac_biba_create_devfs_symlink(struct ucred *cred, struct mount *mp,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(delabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mount(struct ucred *cred, struct mount *mp,
+biba_create_mount(struct ucred *cred, struct mount *mp,
     struct label *mplabel)
 {
 	struct mac_biba *source, *dest;
 
 	source = SLOT(cred->cr_label);
 	dest = SLOT(mplabel);
-	mac_biba_copy_effective(source, dest);
+
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_relabel_vnode(struct ucred *cred, struct vnode *vp,
+biba_relabel_vnode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *newlabel)
 {
 	struct mac_biba *source, *dest;
@@ -847,11 +836,11 @@ mac_biba_relabel_vnode(struct ucred *cred, struct vnode *vp,
 	source = SLOT(newlabel);
 	dest = SLOT(vplabel);
 
-	mac_biba_copy(source, dest);
+	biba_copy(source, dest);
 }
 
 static void
-mac_biba_update_devfs(struct mount *mp, struct devfs_dirent *de,
+biba_update_devfs(struct mount *mp, struct devfs_dirent *de,
     struct label *delabel, struct vnode *vp, struct label *vplabel)
 {
 	struct mac_biba *source, *dest;
@@ -859,11 +848,11 @@ mac_biba_update_devfs(struct mount *mp, struct devfs_dirent *de,
 	source = SLOT(vplabel);
 	dest = SLOT(delabel);
 
-	mac_biba_copy(source, dest);
+	biba_copy(source, dest);
 }
 
 static void
-mac_biba_associate_vnode_devfs(struct mount *mp, struct label *mntlabel,
+biba_associate_vnode_devfs(struct mount *mp, struct label *mntlabel,
     struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
     struct label *vplabel)
 {
@@ -872,11 +861,11 @@ mac_biba_associate_vnode_devfs(struct mount *mp, struct label *mntlabel,
 	source = SLOT(delabel);
 	dest = SLOT(vplabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static int
-mac_biba_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
+biba_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_biba temp, *source, *dest;
@@ -892,31 +881,31 @@ mac_biba_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
 	    MAC_BIBA_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
 	if (error == ENOATTR || error == EOPNOTSUPP) {
 		/* Fall back to the mntlabel. */
-		mac_biba_copy_effective(source, dest);
+		biba_copy_effective(source, dest);
 		return (0);
 	} else if (error)
 		return (error);
 
 	if (buflen != sizeof(temp)) {
-		printf("mac_biba_associate_vnode_extattr: bad size %d\n",
+		printf("biba_associate_vnode_extattr: bad size %d\n",
 		    buflen);
 		return (EPERM);
 	}
-	if (mac_biba_valid(&temp) != 0) {
-		printf("mac_biba_associate_vnode_extattr: invalid\n");
+	if (biba_valid(&temp) != 0) {
+		printf("biba_associate_vnode_extattr: invalid\n");
 		return (EPERM);
 	}
 	if ((temp.mb_flags & MAC_BIBA_FLAGS_BOTH) != MAC_BIBA_FLAG_EFFECTIVE) {
-		printf("mac_biba_associate_vnode_extattr: not effective\n");
+		printf("biba_associate_vnode_extattr: not effective\n");
 		return (EPERM);
 	}
 
-	mac_biba_copy_effective(&temp, dest);
+	biba_copy_effective(&temp, dest);
 	return (0);
 }
 
 static void
-mac_biba_associate_vnode_singlelabel(struct mount *mp,
+biba_associate_vnode_singlelabel(struct mount *mp,
     struct label *mplabel, struct vnode *vp, struct label *vplabel)
 {
 	struct mac_biba *source, *dest;
@@ -924,11 +913,11 @@ mac_biba_associate_vnode_singlelabel(struct mount *mp,
 	source = SLOT(mplabel);
 	dest = SLOT(vplabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static int
-mac_biba_create_vnode_extattr(struct ucred *cred, struct mount *mp,
+biba_create_vnode_extattr(struct ucred *cred, struct mount *mp,
     struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
     struct vnode *vp, struct label *vplabel, struct componentname *cnp)
 {
@@ -941,17 +930,17 @@ mac_biba_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 
 	source = SLOT(cred->cr_label);
 	dest = SLOT(vplabel);
-	mac_biba_copy_effective(source, &temp);
+	biba_copy_effective(source, &temp);
 
 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
 	    MAC_BIBA_EXTATTR_NAME, buflen, (char *) &temp, curthread);
 	if (error == 0)
-		mac_biba_copy_effective(source, dest);
+		biba_copy_effective(source, dest);
 	return (error);
 }
 
 static int
-mac_biba_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
+biba_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *intlabel)
 {
 	struct mac_biba *source, temp;
@@ -965,7 +954,7 @@ mac_biba_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
 	if ((source->mb_flags & MAC_BIBA_FLAG_EFFECTIVE) == 0)
 		return (0);
 
-	mac_biba_copy_effective(source, &temp);
+	biba_copy_effective(source, &temp);
 
 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_BIBA_EXTATTR_NAMESPACE,
 	    MAC_BIBA_EXTATTR_NAME, buflen, (char *) &temp, curthread);
@@ -976,7 +965,7 @@ mac_biba_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
  * Labeling event operations: IPC object.
  */
 static void
-mac_biba_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+biba_create_inpcb_from_socket(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 	struct mac_biba *source, *dest;
@@ -984,11 +973,11 @@ mac_biba_create_inpcb_from_socket(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(inplabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_from_socket(struct socket *so, struct label *solabel,
+biba_create_mbuf_from_socket(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *source, *dest;
@@ -996,11 +985,11 @@ mac_biba_create_mbuf_from_socket(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(mlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_socket(struct ucred *cred, struct socket *so,
+biba_create_socket(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 	struct mac_biba *source, *dest;
@@ -1008,11 +997,11 @@ mac_biba_create_socket(struct ucred *cred, struct socket *so,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(solabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_pipe(struct ucred *cred, struct pipepair *pp,
+biba_create_pipe(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_biba *source, *dest;
@@ -1020,11 +1009,11 @@ mac_biba_create_pipe(struct ucred *cred, struct pipepair *pp,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(pplabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_posix_sem(struct ucred *cred, struct ksem *ks,
+biba_create_posix_sem(struct ucred *cred, struct ksem *ks,
     struct label *kslabel)
 {
 	struct mac_biba *source, *dest;
@@ -1032,11 +1021,11 @@ mac_biba_create_posix_sem(struct ucred *cred, struct ksem *ks,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(kslabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_socket_from_socket(struct socket *oldso,
+biba_create_socket_from_socket(struct socket *oldso,
     struct label *oldsolabel, struct socket *newso, struct label *newsolabel)
 {
 	struct mac_biba *source, *dest;
@@ -1044,11 +1033,11 @@ mac_biba_create_socket_from_socket(struct socket *oldso,
 	source = SLOT(oldsolabel);
 	dest = SLOT(newsolabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_relabel_socket(struct ucred *cred, struct socket *so,
+biba_relabel_socket(struct ucred *cred, struct socket *so,
     struct label *solabel, struct label *newlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1056,11 +1045,11 @@ mac_biba_relabel_socket(struct ucred *cred, struct socket *so,
 	source = SLOT(newlabel);
 	dest = SLOT(solabel);
 
-	mac_biba_copy(source, dest);
+	biba_copy(source, dest);
 }
 
 static void
-mac_biba_relabel_pipe(struct ucred *cred, struct pipepair *pp,
+biba_relabel_pipe(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, struct label *newlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1068,11 +1057,11 @@ mac_biba_relabel_pipe(struct ucred *cred, struct pipepair *pp,
 	source = SLOT(newlabel);
 	dest = SLOT(pplabel);
 
-	mac_biba_copy(source, dest);
+	biba_copy(source, dest);
 }
 
 static void
-mac_biba_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
+biba_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
     struct socket *so, struct label *sopeerlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1080,14 +1069,14 @@ mac_biba_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(sopeerlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 /*
  * Labeling event operations: System V IPC objects.
  */
 static void
-mac_biba_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
+biba_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
 {
 	struct mac_biba *source, *dest;
@@ -1096,11 +1085,11 @@ mac_biba_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(msglabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_sysv_msgqueue(struct ucred *cred,
+biba_create_sysv_msgqueue(struct ucred *cred,
     struct msqid_kernel *msqkptr, struct label *msqlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1108,11 +1097,11 @@ mac_biba_create_sysv_msgqueue(struct ucred *cred,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(msqlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
+biba_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semalabel)
 {
 	struct mac_biba *source, *dest;
@@ -1120,11 +1109,11 @@ mac_biba_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(semalabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
+biba_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1132,14 +1121,14 @@ mac_biba_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(shmlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 /*
  * Labeling event operations: network objects.
  */
 static void
-mac_biba_set_socket_peer_from_socket(struct socket *oldso,
+biba_set_socket_peer_from_socket(struct socket *oldso,
     struct label *oldsolabel, struct socket *newso,
     struct label *newsopeerlabel)
 {
@@ -1148,11 +1137,11 @@ mac_biba_set_socket_peer_from_socket(struct socket *oldso,
 	source = SLOT(oldsolabel);
 	dest = SLOT(newsopeerlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
+biba_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
     struct label *dlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1160,11 +1149,11 @@ mac_biba_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(dlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
+biba_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
 {
 	char tifname[IFNAMSIZ], *p, *q;
 	char tiflist[sizeof(trusted_interfaces)];
@@ -1216,12 +1205,12 @@ mac_biba_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
 		}
 	}
 set:
-	mac_biba_set_effective(dest, type, 0, NULL);
-	mac_biba_set_range(dest, type, 0, NULL, type, 0, NULL);
+	biba_set_effective(dest, type, 0, NULL);
+	biba_set_range(dest, type, 0, NULL, type, 0, NULL);
 }
 
 static void
-mac_biba_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
+biba_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
     struct label *ipqlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1229,11 +1218,11 @@ mac_biba_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
 	source = SLOT(mlabel);
 	dest = SLOT(ipqlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
+biba_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1242,11 +1231,11 @@ mac_biba_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
 	dest = SLOT(mlabel);
 
 	/* Just use the head, since we require them all to match. */
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_fragment(struct mbuf *m, struct label *mlabel,
+biba_create_fragment(struct mbuf *m, struct label *mlabel,
     struct mbuf *frag, struct label *fraglabel)
 {
 	struct mac_biba *source, *dest;
@@ -1254,11 +1243,11 @@ mac_biba_create_fragment(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(fraglabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
+biba_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1266,22 +1255,22 @@ mac_biba_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
 	source = SLOT(inplabel);
 	dest = SLOT(mlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
+biba_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *dest;
 
 	dest = SLOT(mlabel);
 
-	mac_biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
+	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
 }
 
 static void
-mac_biba_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
+biba_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1289,11 +1278,11 @@ mac_biba_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
 	source = SLOT(dlabel);
 	dest = SLOT(mlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
+biba_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1301,11 +1290,11 @@ mac_biba_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
 	source = SLOT(ifplabel);
 	dest = SLOT(mlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
+biba_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
     struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew,
     struct label *mnewlabel)
 {
@@ -1314,11 +1303,11 @@ mac_biba_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(mnewlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
+biba_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
     struct mbuf *newm, struct label *mnewlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1326,11 +1315,11 @@ mac_biba_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(mnewlabel);
 
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static int
-mac_biba_fragment_match(struct mbuf *m, struct label *mlabel,
+biba_fragment_match(struct mbuf *m, struct label *mlabel,
     struct ipq *ipq, struct label *ipqlabel)
 {
 	struct mac_biba *a, *b;
@@ -1338,11 +1327,11 @@ mac_biba_fragment_match(struct mbuf *m, struct label *mlabel,
 	a = SLOT(ipqlabel);
 	b = SLOT(mlabel);
 
-	return (mac_biba_equal_effective(a, b));
+	return (biba_equal_effective(a, b));
 }
 
 static void
-mac_biba_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
+biba_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
     struct label *ifplabel, struct label *newlabel)
 {
 	struct mac_biba *source, *dest;
@@ -1350,11 +1339,11 @@ mac_biba_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
 	source = SLOT(newlabel);
 	dest = SLOT(ifplabel);
 
-	mac_biba_copy(source, dest);
+	biba_copy(source, dest);
 }
 
 static void
-mac_biba_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
+biba_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
     struct label *ipqlabel)
 {
 
@@ -1362,7 +1351,7 @@ mac_biba_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
 }
 
 static void
-mac_biba_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+biba_inpcb_sosetlabel(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 	struct mac_biba *source, *dest;
@@ -1370,84 +1359,84 @@ mac_biba_inpcb_sosetlabel(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(inplabel);
 
-	mac_biba_copy(source, dest);
+	biba_copy(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_from_firewall(struct mbuf *m, struct label *label)
+biba_create_mbuf_from_firewall(struct mbuf *m, struct label *label)
 {
 	struct mac_biba *dest;
 
 	dest = SLOT(label);
 
 	/* XXX: where is the label for the firewall really comming from? */
-	mac_biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
+	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
 }
 
 /*
  * Labeling event operations: processes.
  */
 static void
-mac_biba_create_proc0(struct ucred *cred)
+biba_create_proc0(struct ucred *cred)
 {
 	struct mac_biba *dest;
 
 	dest = SLOT(cred->cr_label);
 
-	mac_biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
-	mac_biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL,
-	    MAC_BIBA_TYPE_HIGH, 0, NULL);
+	biba_set_effective(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
+	biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH,
+	    0, NULL);
 }
 
 static void
-mac_biba_create_proc1(struct ucred *cred)
+biba_create_proc1(struct ucred *cred)
 {
 	struct mac_biba *dest;
 
 	dest = SLOT(cred->cr_label);
 
-	mac_biba_set_effective(dest, MAC_BIBA_TYPE_HIGH, 0, NULL);
-	mac_biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL,
-	    MAC_BIBA_TYPE_HIGH, 0, NULL);
+	biba_set_effective(dest, MAC_BIBA_TYPE_HIGH, 0, NULL);
+	biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH,
+	    0, NULL);
 }
 
 static void
-mac_biba_relabel_cred(struct ucred *cred, struct label *newlabel)
+biba_relabel_cred(struct ucred *cred, struct label *newlabel)
 {
 	struct mac_biba *source, *dest;
 
 	source = SLOT(newlabel);
 	dest = SLOT(cred->cr_label);
 
-	mac_biba_copy(source, dest);
+	biba_copy(source, dest);
 }
 
 /*
  * Label cleanup/flush operations
  */
 static void
-mac_biba_cleanup_sysv_msgmsg(struct label *msglabel)
+biba_cleanup_sysv_msgmsg(struct label *msglabel)
 {
 
 	bzero(SLOT(msglabel), sizeof(struct mac_biba));
 }
 
 static void
-mac_biba_cleanup_sysv_msgqueue(struct label *msqlabel)
+biba_cleanup_sysv_msgqueue(struct label *msqlabel)
 {
 
 	bzero(SLOT(msqlabel), sizeof(struct mac_biba));
 }
 
 static void
-mac_biba_cleanup_sysv_sem(struct label *semalabel)
+biba_cleanup_sysv_sem(struct label *semalabel)
 {
 
 	bzero(SLOT(semalabel), sizeof(struct mac_biba));
 }
 
 static void
-mac_biba_cleanup_sysv_shm(struct label *shmlabel)
+biba_cleanup_sysv_shm(struct label *shmlabel)
 {
 	bzero(SLOT(shmlabel), sizeof(struct mac_biba));
 }
@@ -1456,24 +1445,24 @@ mac_biba_cleanup_sysv_shm(struct label *shmlabel)
  * Access control checks.
  */
 static int
-mac_biba_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
+biba_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
     struct ifnet *ifp, struct label *ifplabel)
 {
 	struct mac_biba *a, *b;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	a = SLOT(dlabel);
 	b = SLOT(ifplabel);
 
-	if (mac_biba_equal_effective(a, b))
+	if (biba_equal_effective(a, b))
 		return (0);
 	return (EACCES);
 }
 
 static int
-mac_biba_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+biba_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 {
 	struct mac_biba *subj, *new;
 	int error;
@@ -1482,8 +1471,8 @@ mac_biba_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 	new = SLOT(newlabel);
 
 	/*
-	 * If there is a Biba label update for the credential, it may
-	 * be an update of the effective, range, or both.
+	 * If there is a Biba label update for the credential, it may be an
+	 * update of the effective, range, or both.
 	 */
 	error = biba_atmostflags(new, MAC_BIBA_FLAGS_BOTH);
 	if (error)
@@ -1500,7 +1489,7 @@ mac_biba_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 		 */
 		if ((new->mb_flags & MAC_BIBA_FLAGS_BOTH) ==
 		    MAC_BIBA_FLAGS_BOTH &&
-		    !mac_biba_effective_in_range(new, new))
+		    !biba_effective_in_range(new, new))
 			return (EINVAL);
 
 		/*
@@ -1508,24 +1497,23 @@ mac_biba_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 		 * new effective label must be in the current range.
 		 */
 		if (new->mb_flags & MAC_BIBA_FLAG_EFFECTIVE &&
-		    !mac_biba_effective_in_range(new, subj))
+		    !biba_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To change the Biba range on a credential, the new
-		 * range label must be in the current range.
+		 * To change the Biba range on a credential, the new range
+		 * label must be in the current range.
 		 */
 		if (new->mb_flags & MAC_BIBA_FLAG_RANGE &&
-		    !mac_biba_range_in_range(new, subj))
+		    !biba_range_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To have EQUAL in any component of the new credential
-		 * Biba label, the subject must already have EQUAL in
-		 * their label.
+		 * To have EQUAL in any component of the new credential Biba
+		 * label, the subject must already have EQUAL in their label.
 		 */
-		if (mac_biba_contains_equal(new)) {
-			error = mac_biba_subject_privileged(subj);
+		if (biba_contains_equal(new)) {
+			error = biba_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1535,25 +1523,25 @@ mac_biba_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 }
 
 static int
-mac_biba_check_cred_visible(struct ucred *u1, struct ucred *u2)
+biba_check_cred_visible(struct ucred *u1, struct ucred *u2)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(u1->cr_label);
 	obj = SLOT(u2->cr_label);
 
 	/* XXX: range */
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (ESRCH);
 
 	return (0);
 }
 
 static int
-mac_biba_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
+biba_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
     struct label *ifplabel, struct label *newlabel)
 {
 	struct mac_biba *subj, *new;
@@ -1563,8 +1551,8 @@ mac_biba_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 	new = SLOT(newlabel);
 
 	/*
-	 * If there is a Biba label update for the interface, it may
-	 * be an update of the effective, range, or both.
+	 * If there is a Biba label update for the interface, it may be an
+	 * update of the effective, range, or both.
 	 */
 	error = biba_atmostflags(new, MAC_BIBA_FLAGS_BOTH);
 	if (error)
@@ -1573,7 +1561,7 @@ mac_biba_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 	/*
 	 * Relabling network interfaces requires Biba privilege.
 	 */
-	error = mac_biba_subject_privileged(subj);
+	error = biba_subject_privileged(subj);
 	if (error)
 		return (error);
 
@@ -1581,133 +1569,132 @@ mac_biba_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 }
 
 static int
-mac_biba_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
+biba_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *p, *i;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	i = SLOT(ifplabel);
 
-	return (mac_biba_effective_in_range(p, i) ? 0 : EACCES);
+	return (biba_effective_in_range(p, i) ? 0 : EACCES);
 }
 
 static int
-mac_biba_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+biba_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *p, *i;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	i = SLOT(inplabel);
 
-	return (mac_biba_equal_effective(p, i) ? 0 : EACCES);
+	return (biba_equal_effective(p, i) ? 0 : EACCES);
 }
 
 static int
-mac_biba_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
+biba_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
     struct label *msglabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msglabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
+biba_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
     struct label *msglabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msglabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
+biba_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msqklabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
+biba_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msqklabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
+biba_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msqklabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
-
 static int
-mac_biba_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
+biba_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel, int cmd)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -1716,12 +1703,12 @@ mac_biba_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
 	switch(cmd) {
 	case IPC_RMID:
 	case IPC_SET:
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 		break;
 
 	case IPC_STAT:
-		if (!mac_biba_dominate_effective(obj, subj))
+		if (!biba_dominate_effective(obj, subj))
 			return (EACCES);
 		break;
 
@@ -1733,12 +1720,12 @@ mac_biba_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
 }
 
 static int
-mac_biba_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
+biba_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel, int cmd)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -1749,7 +1736,7 @@ mac_biba_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 	case IPC_SET:
 	case SETVAL:
 	case SETALL:
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 		break;
 
@@ -1759,7 +1746,7 @@ mac_biba_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 	case GETNCNT:
 	case GETZCNT:
 	case GETALL:
-		if (!mac_biba_dominate_effective(obj, subj))
+		if (!biba_dominate_effective(obj, subj))
 			return (EACCES);
 		break;
 
@@ -1771,63 +1758,62 @@ mac_biba_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 }
 
 static int
-mac_biba_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
+biba_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(semaklabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
-
 static int
-mac_biba_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
+biba_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel, size_t accesstype)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(semaklabel);
 
 	if (accesstype & SEM_R)
-		if (!mac_biba_dominate_effective(obj, subj))
+		if (!biba_dominate_effective(obj, subj))
 			return (EACCES);
 
 	if (accesstype & SEM_A)
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
+biba_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int shmflg)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(shmseglabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 	if ((shmflg & SHM_RDONLY) == 0) {
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 	}
 	
@@ -1835,12 +1821,12 @@ mac_biba_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
 }
 
 static int
-mac_biba_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
+biba_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int cmd)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -1849,13 +1835,13 @@ mac_biba_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
 	switch(cmd) {
 	case IPC_RMID:
 	case IPC_SET:
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 		break;
 
 	case IPC_STAT:
 	case SHM_STAT:
-		if (!mac_biba_dominate_effective(obj, subj))
+		if (!biba_dominate_effective(obj, subj))
 			return (EACCES);
 		break;
 
@@ -1867,70 +1853,70 @@ mac_biba_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
 }
 
 static int
-mac_biba_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
+biba_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int shmflg)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(shmseglabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_kld_load(struct ucred *cred, struct vnode *vp,
+biba_check_kld_load(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
-	error = mac_biba_subject_privileged(subj);
+	error = biba_subject_privileged(subj);
 	if (error)
 		return (error);
 
 	obj = SLOT(vplabel);
-	if (!mac_biba_high_effective(obj))
+	if (!biba_high_effective(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_mount_stat(struct ucred *cred, struct mount *mp,
+biba_check_mount_stat(struct ucred *cred, struct mount *mp,
     struct label *mplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(mplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
+biba_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
 {
 
-	if(!mac_biba_enabled)
+	if(!biba_enabled)
 		return (0);
 
 	/* XXX: This will be implemented soon... */
@@ -1939,43 +1925,43 @@ mac_biba_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
 }
 
 static int
-mac_biba_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
+biba_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_pipe_read(struct ucred *cred, struct pipepair *pp,
+biba_check_pipe_read(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
+biba_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, struct label *newlabel)
 {
 	struct mac_biba *subj, *obj, *new;
@@ -1986,8 +1972,8 @@ mac_biba_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	obj = SLOT(pplabel);
 
 	/*
-	 * If there is a Biba label update for a pipe, it must be a
-	 * effective update.
+	 * If there is a Biba label update for a pipe, it must be a effective
+	 * update.
 	 */
 	error = biba_atmostflags(new, MAC_BIBA_FLAG_EFFECTIVE);
 	if (error)
@@ -1997,7 +1983,7 @@ mac_biba_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	 * To perform a relabel of a pipe (Biba label or not), Biba must
 	 * authorize the relabel.
 	 */
-	if (!mac_biba_effective_in_range(obj, subj))
+	if (!biba_effective_in_range(obj, subj))
 		return (EPERM);
 
 	/*
@@ -2008,15 +1994,15 @@ mac_biba_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 		 * To change the Biba label on a pipe, the new pipe label
 		 * must be in the subject range.
 		 */
-		if (!mac_biba_effective_in_range(new, subj))
+		if (!biba_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
 		 * To change the Biba label on a pipe to be EQUAL, the
 		 * subject must have appropriate privilege.
 		 */
-		if (mac_biba_contains_equal(new)) {
-			error = mac_biba_subject_privileged(subj);
+		if (biba_contains_equal(new)) {
+			error = biba_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2026,154 +2012,154 @@ mac_biba_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 }
 
 static int
-mac_biba_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
+biba_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_pipe_write(struct ucred *cred, struct pipepair *pp,
+biba_check_pipe_write(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_posix_sem_write(struct ucred *cred, struct ksem *ks,
+biba_check_posix_sem_write(struct ucred *cred, struct ksem *ks,
     struct label *kslabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(kslabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_posix_sem_rdonly(struct ucred *cred, struct ksem *ks,
+biba_check_posix_sem_rdonly(struct ucred *cred, struct ksem *ks,
     struct label *kslabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(kslabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_proc_debug(struct ucred *cred, struct proc *p)
+biba_check_proc_debug(struct ucred *cred, struct proc *p)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (ESRCH);
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_proc_sched(struct ucred *cred, struct proc *p)
+biba_check_proc_sched(struct ucred *cred, struct proc *p)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (ESRCH);
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
+biba_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (ESRCH);
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_socket_deliver(struct socket *so, struct label *solabel,
+biba_check_socket_deliver(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_biba *p, *s;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	s = SLOT(solabel);
 
-	return (mac_biba_equal_effective(p, s) ? 0 : EACCES);
+	return (biba_equal_effective(p, s) ? 0 : EACCES);
 }
 
 static int
-mac_biba_check_socket_relabel(struct ucred *cred, struct socket *so,
+biba_check_socket_relabel(struct ucred *cred, struct socket *so,
     struct label *solabel, struct label *newlabel)
 {
 	struct mac_biba *subj, *obj, *new;
@@ -2184,18 +2170,18 @@ mac_biba_check_socket_relabel(struct ucred *cred, struct socket *so,
 	obj = SLOT(solabel);
 
 	/*
-	 * If there is a Biba label update for the socket, it may be
-	 * an update of effective.
+	 * If there is a Biba label update for the socket, it may be an
+	 * update of effective.
 	 */
 	error = biba_atmostflags(new, MAC_BIBA_FLAG_EFFECTIVE);
 	if (error)
 		return (error);
 
 	/*
-	 * To relabel a socket, the old socket effective must be in the subject
-	 * range.
+	 * To relabel a socket, the old socket effective must be in the
+	 * subject range.
 	 */
-	if (!mac_biba_effective_in_range(obj, subj))
+	if (!biba_effective_in_range(obj, subj))
 		return (EPERM);
 
 	/*
@@ -2206,15 +2192,15 @@ mac_biba_check_socket_relabel(struct ucred *cred, struct socket *so,
 		 * To relabel a socket, the new socket effective must be in
 		 * the subject range.
 		 */
-		if (!mac_biba_effective_in_range(new, subj))
+		if (!biba_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
 		 * To change the Biba label on the socket to contain EQUAL,
 		 * the subject must have appropriate privilege.
 		 */
-		if (mac_biba_contains_equal(new)) {
-			error = mac_biba_subject_privileged(subj);
+		if (biba_contains_equal(new)) {
+			error = biba_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2224,18 +2210,18 @@ mac_biba_check_socket_relabel(struct ucred *cred, struct socket *so,
 }
 
 static int
-mac_biba_check_socket_visible(struct ucred *cred, struct socket *so,
+biba_check_socket_visible(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(solabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (ENOENT);
 
 	return (0);
@@ -2247,12 +2233,12 @@ mac_biba_check_socket_visible(struct ucred *cred, struct socket *so,
  * policy as they might otherwise allow bypassing of the integrity policy.
  */
 static int
-mac_biba_priv_check(struct ucred *cred, int priv)
+biba_priv_check(struct ucred *cred, int priv)
 {
 	struct mac_biba *subj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	/*
@@ -2423,7 +2409,7 @@ mac_biba_priv_check(struct ucred *cred, int priv)
 	 */
 	default:
 		subj = SLOT(cred->cr_label);
-		error = mac_biba_subject_privileged(subj);
+		error = biba_subject_privileged(subj);
 		if (error)
 			return (error);
 	}
@@ -2431,18 +2417,18 @@ mac_biba_priv_check(struct ucred *cred, int priv)
 }
 
 static int
-mac_biba_check_system_acct(struct ucred *cred, struct vnode *vp,
+biba_check_system_acct(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
-	error = mac_biba_subject_privileged(subj);
+	error = biba_subject_privileged(subj);
 	if (error)
 		return (error);
 
@@ -2450,25 +2436,25 @@ mac_biba_check_system_acct(struct ucred *cred, struct vnode *vp,
 		return (0);
 
 	obj = SLOT(vplabel);
-	if (!mac_biba_high_effective(obj))
+	if (!biba_high_effective(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_system_auditctl(struct ucred *cred, struct vnode *vp,
+biba_check_system_auditctl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
-	error = mac_biba_subject_privileged(subj);
+	error = biba_subject_privileged(subj);
 	if (error)
 		return (error);
 
@@ -2476,24 +2462,24 @@ mac_biba_check_system_auditctl(struct ucred *cred, struct vnode *vp,
 		return (0);
 
 	obj = SLOT(vplabel);
-	if (!mac_biba_high_effective(obj))
+	if (!biba_high_effective(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_system_auditon(struct ucred *cred, int cmd)
+biba_check_system_auditon(struct ucred *cred, int cmd)
 {
 	struct mac_biba *subj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
-	error = mac_biba_subject_privileged(subj);
+	error = biba_subject_privileged(subj);
 	if (error)
 		return (error);
 
@@ -2501,41 +2487,41 @@ mac_biba_check_system_auditon(struct ucred *cred, int cmd)
 }
 
 static int
-mac_biba_check_system_swapon(struct ucred *cred, struct vnode *vp,
+biba_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	error = mac_biba_subject_privileged(subj);
+	error = biba_subject_privileged(subj);
 	if (error)
 		return (error);
 
-	if (!mac_biba_high_effective(obj))
+	if (!biba_high_effective(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_system_swapoff(struct ucred *cred, struct vnode *vp,
+biba_check_system_swapoff(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
 	struct mac_biba *subj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
-	error = mac_biba_subject_privileged(subj);
+	error = biba_subject_privileged(subj);
 	if (error)
 		return (error);
 
@@ -2543,26 +2529,26 @@ mac_biba_check_system_swapoff(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_biba_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
+biba_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
     void *arg1, int arg2, struct sysctl_req *req)
 {
 	struct mac_biba *subj;
 	int error;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
 	/*
-	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as
-	 * biba/high, but also require privilege to change them.
+	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as biba/high,
+	 * but also require privilege to change them.
 	 */
 	if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
-		if (!mac_biba_subject_dominate_high(subj))
+		if (!biba_subject_dominate_high(subj))
 			return (EACCES);
 
-		error = mac_biba_subject_privileged(subj);
+		error = biba_subject_privileged(subj);
 		if (error)
 			return (error);
 	}
@@ -2571,97 +2557,97 @@ mac_biba_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
 }
 
 static int
-mac_biba_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_create(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_exec(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_exec(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct image_params *imgp,
     struct label *execlabel)
 {
@@ -2671,8 +2657,8 @@ mac_biba_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 	if (execlabel != NULL) {
 		/*
 		 * We currently don't permit labels to be changed at
-		 * exec-time as part of Biba, so disallow non-NULL
-		 * Biba label elements in the execlabel.
+		 * exec-time as part of Biba, so disallow non-NULL Biba label
+		 * elements in the execlabel.
 		 */
 		exec = SLOT(execlabel);
 		error = biba_atmostflags(exec, 0);
@@ -2680,117 +2666,117 @@ mac_biba_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 			return (error);
 	}
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_link(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_link(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int prot, int flags)
 {
 	struct mac_biba *subj, *obj;
@@ -2799,18 +2785,18 @@ mac_biba_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 	 * Rely on the use of open()-time protections to handle
 	 * non-revocation cases.
 	 */
-	if (!mac_biba_enabled || !revocation_enabled)
+	if (!biba_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
 	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
-		if (!mac_biba_dominate_effective(obj, subj))
+		if (!biba_dominate_effective(obj, subj))
 			return (EACCES);
 	}
 	if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 	}
 
@@ -2818,12 +2804,12 @@ mac_biba_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_biba_check_vnode_open(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_open(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int acc_mode)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -2831,11 +2817,11 @@ mac_biba_check_vnode_open(struct ucred *cred, struct vnode *vp,
 
 	/* XXX privilege override for admin? */
 	if (acc_mode & (VREAD | VEXEC | VSTAT)) {
-		if (!mac_biba_dominate_effective(obj, subj))
+		if (!biba_dominate_effective(obj, subj))
 			return (EACCES);
 	}
 	if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 	}
 
@@ -2843,79 +2829,79 @@ mac_biba_check_vnode_open(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_biba_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+biba_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled || !revocation_enabled)
+	if (!biba_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+biba_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled || !revocation_enabled)
+	if (!biba_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *newlabel)
 {
 	struct mac_biba *old, *new, *subj;
@@ -2937,7 +2923,7 @@ mac_biba_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 	 * To perform a relabel of the vnode (Biba label or not), Biba must
 	 * authorize the relabel.
 	 */
-	if (!mac_biba_effective_in_range(old, subj))
+	if (!biba_effective_in_range(old, subj))
 		return (EPERM);
 
 	/*
@@ -2948,15 +2934,15 @@ mac_biba_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 		 * To change the Biba label on a vnode, the new vnode label
 		 * must be in the subject range.
 		 */
-		if (!mac_biba_effective_in_range(new, subj))
+		if (!biba_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To change the Biba label on the vnode to be EQUAL,
-		 * the subject must have appropriate privilege.
+		 * To change the Biba label on the vnode to be EQUAL, the
+		 * subject must have appropriate privilege.
 		 */
-		if (mac_biba_contains_equal(new)) {
-			error = mac_biba_subject_privileged(subj);
+		if (biba_contains_equal(new)) {
+			error = biba_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2966,49 +2952,49 @@ mac_biba_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_biba_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     int samedir, struct componentname *cnp)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	if (vp != NULL) {
 		obj = SLOT(vplabel);
 
-		if (!mac_biba_dominate_effective(subj, obj))
+		if (!biba_dominate_effective(subj, obj))
 			return (EACCES);
 	}
 
@@ -3016,55 +3002,55 @@ mac_biba_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 }
 
 static int
-mac_biba_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type, struct acl *acl)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	/* XXX: protect the MAC EA in a special way? */
@@ -3073,353 +3059,353 @@ mac_biba_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_biba_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, u_long flags)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, mode_t mode)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, uid_t uid, gid_t gid)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+biba_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct timespec atime, struct timespec mtime)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+biba_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(obj, subj))
+	if (!biba_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
+biba_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled)
+	if (!biba_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_biba_check_vnode_write(struct ucred *active_cred,
-    struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
+biba_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+    struct vnode *vp, struct label *vplabel)
 {
 	struct mac_biba *subj, *obj;
 
-	if (!mac_biba_enabled || !revocation_enabled)
+	if (!biba_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_biba_dominate_effective(subj, obj))
+	if (!biba_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static void
-mac_biba_associate_nfsd_label(struct ucred *cred)
+biba_associate_nfsd_label(struct ucred *cred)
 {
 	struct mac_biba *label;
 
 	label = SLOT(cred->cr_label);
-	mac_biba_set_effective(label, MAC_BIBA_TYPE_LOW, 0, NULL);
-	mac_biba_set_range(label, MAC_BIBA_TYPE_LOW, 0, NULL,
-	    MAC_BIBA_TYPE_HIGH, 0, NULL);
+	biba_set_effective(label, MAC_BIBA_TYPE_LOW, 0, NULL);
+	biba_set_range(label, MAC_BIBA_TYPE_LOW, 0, NULL, MAC_BIBA_TYPE_HIGH,
+	    0, NULL);
 }
 
 static void
-mac_biba_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
+biba_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
 {
 	struct mac_biba *source, *dest;
 
 	source = SLOT(inp->inp_label);
 	dest = SLOT(label);
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static void
-mac_biba_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
+biba_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
     struct label *mlabel)
 {
 	struct mac_biba *source, *dest;
 
 	source = SLOT(sc_label);
 	dest = SLOT(mlabel);
-	mac_biba_copy_effective(source, dest);
+	biba_copy_effective(source, dest);
 }
 
 static struct mac_policy_ops mac_biba_ops =
 {
-	.mpo_init = mac_biba_init,
-	.mpo_init_bpfdesc_label = mac_biba_init_label,
-	.mpo_init_cred_label = mac_biba_init_label,
-	.mpo_init_devfs_label = mac_biba_init_label,
-	.mpo_init_ifnet_label = mac_biba_init_label,
-	.mpo_init_inpcb_label = mac_biba_init_label_waitcheck,
-	.mpo_init_syncache_label = mac_biba_init_label_waitcheck,
-	.mpo_init_sysv_msgmsg_label = mac_biba_init_label,
-	.mpo_init_sysv_msgqueue_label = mac_biba_init_label,
-	.mpo_init_sysv_sem_label = mac_biba_init_label,
-	.mpo_init_sysv_shm_label = mac_biba_init_label,
-	.mpo_init_ipq_label = mac_biba_init_label_waitcheck,
-	.mpo_init_mbuf_label = mac_biba_init_label_waitcheck,
-	.mpo_init_mount_label = mac_biba_init_label,
-	.mpo_init_pipe_label = mac_biba_init_label,
-	.mpo_init_posix_sem_label = mac_biba_init_label,
-	.mpo_init_socket_label = mac_biba_init_label_waitcheck,
-	.mpo_init_socket_peer_label = mac_biba_init_label_waitcheck,
-	.mpo_init_syncache_from_inpcb = mac_biba_init_syncache_from_inpcb,
-	.mpo_init_vnode_label = mac_biba_init_label,
-	.mpo_destroy_bpfdesc_label = mac_biba_destroy_label,
-	.mpo_destroy_cred_label = mac_biba_destroy_label,
-	.mpo_destroy_devfs_label = mac_biba_destroy_label,
-	.mpo_destroy_ifnet_label = mac_biba_destroy_label,
-	.mpo_destroy_inpcb_label = mac_biba_destroy_label,
-	.mpo_destroy_syncache_label = mac_biba_destroy_label,
-	.mpo_destroy_sysv_msgmsg_label = mac_biba_destroy_label,
-	.mpo_destroy_sysv_msgqueue_label = mac_biba_destroy_label,
-	.mpo_destroy_sysv_sem_label = mac_biba_destroy_label,
-	.mpo_destroy_sysv_shm_label = mac_biba_destroy_label,
-	.mpo_destroy_ipq_label = mac_biba_destroy_label,
-	.mpo_destroy_mbuf_label = mac_biba_destroy_label,
-	.mpo_destroy_mount_label = mac_biba_destroy_label,
-	.mpo_destroy_pipe_label = mac_biba_destroy_label,
-	.mpo_destroy_posix_sem_label = mac_biba_destroy_label,
-	.mpo_destroy_socket_label = mac_biba_destroy_label,
-	.mpo_destroy_socket_peer_label = mac_biba_destroy_label,
-	.mpo_destroy_vnode_label = mac_biba_destroy_label,
-	.mpo_copy_cred_label = mac_biba_copy_label,
-	.mpo_copy_ifnet_label = mac_biba_copy_label,
-	.mpo_copy_mbuf_label = mac_biba_copy_label,
-	.mpo_copy_pipe_label = mac_biba_copy_label,
-	.mpo_copy_socket_label = mac_biba_copy_label,
-	.mpo_copy_vnode_label = mac_biba_copy_label,
-	.mpo_externalize_cred_label = mac_biba_externalize_label,
-	.mpo_externalize_ifnet_label = mac_biba_externalize_label,
-	.mpo_externalize_pipe_label = mac_biba_externalize_label,
-	.mpo_externalize_socket_label = mac_biba_externalize_label,
-	.mpo_externalize_socket_peer_label = mac_biba_externalize_label,
-	.mpo_externalize_vnode_label = mac_biba_externalize_label,
-	.mpo_internalize_cred_label = mac_biba_internalize_label,
-	.mpo_internalize_ifnet_label = mac_biba_internalize_label,
-	.mpo_internalize_pipe_label = mac_biba_internalize_label,
-	.mpo_internalize_socket_label = mac_biba_internalize_label,
-	.mpo_internalize_vnode_label = mac_biba_internalize_label,
-	.mpo_create_devfs_device = mac_biba_create_devfs_device,
-	.mpo_create_devfs_directory = mac_biba_create_devfs_directory,
-	.mpo_create_devfs_symlink = mac_biba_create_devfs_symlink,
-	.mpo_create_mount = mac_biba_create_mount,
-	.mpo_relabel_vnode = mac_biba_relabel_vnode,
-	.mpo_update_devfs = mac_biba_update_devfs,
-	.mpo_associate_vnode_devfs = mac_biba_associate_vnode_devfs,
-	.mpo_associate_vnode_extattr = mac_biba_associate_vnode_extattr,
-	.mpo_associate_vnode_singlelabel = mac_biba_associate_vnode_singlelabel,
-	.mpo_create_vnode_extattr = mac_biba_create_vnode_extattr,
-	.mpo_setlabel_vnode_extattr = mac_biba_setlabel_vnode_extattr,
-	.mpo_create_mbuf_from_socket = mac_biba_create_mbuf_from_socket,
-	.mpo_create_mbuf_from_syncache = mac_biba_create_mbuf_from_syncache,
-	.mpo_create_pipe = mac_biba_create_pipe,
-	.mpo_create_posix_sem = mac_biba_create_posix_sem,
-	.mpo_create_socket = mac_biba_create_socket,
-	.mpo_create_socket_from_socket = mac_biba_create_socket_from_socket,
-	.mpo_relabel_pipe = mac_biba_relabel_pipe,
-	.mpo_relabel_socket = mac_biba_relabel_socket,
-	.mpo_set_socket_peer_from_mbuf = mac_biba_set_socket_peer_from_mbuf,
-	.mpo_set_socket_peer_from_socket = mac_biba_set_socket_peer_from_socket,
-	.mpo_create_bpfdesc = mac_biba_create_bpfdesc,
-	.mpo_create_datagram_from_ipq = mac_biba_create_datagram_from_ipq,
-	.mpo_create_fragment = mac_biba_create_fragment,
-	.mpo_create_ifnet = mac_biba_create_ifnet,
-	.mpo_create_inpcb_from_socket = mac_biba_create_inpcb_from_socket,
-	.mpo_create_sysv_msgmsg = mac_biba_create_sysv_msgmsg,
-	.mpo_create_sysv_msgqueue = mac_biba_create_sysv_msgqueue,
-	.mpo_create_sysv_sem = mac_biba_create_sysv_sem,
-	.mpo_create_sysv_shm = mac_biba_create_sysv_shm,
-	.mpo_create_ipq = mac_biba_create_ipq,
-	.mpo_create_mbuf_from_inpcb = mac_biba_create_mbuf_from_inpcb,
-	.mpo_create_mbuf_linklayer = mac_biba_create_mbuf_linklayer,
-	.mpo_create_mbuf_from_bpfdesc = mac_biba_create_mbuf_from_bpfdesc,
-	.mpo_create_mbuf_from_ifnet = mac_biba_create_mbuf_from_ifnet,
-	.mpo_create_mbuf_multicast_encap = mac_biba_create_mbuf_multicast_encap,
-	.mpo_create_mbuf_netlayer = mac_biba_create_mbuf_netlayer,
-	.mpo_fragment_match = mac_biba_fragment_match,
-	.mpo_relabel_ifnet = mac_biba_relabel_ifnet,
-	.mpo_update_ipq = mac_biba_update_ipq,
-	.mpo_inpcb_sosetlabel = mac_biba_inpcb_sosetlabel,
-	.mpo_create_proc0 = mac_biba_create_proc0,
-	.mpo_create_proc1 = mac_biba_create_proc1,
-	.mpo_relabel_cred = mac_biba_relabel_cred,
-	.mpo_cleanup_sysv_msgmsg = mac_biba_cleanup_sysv_msgmsg,
-	.mpo_cleanup_sysv_msgqueue = mac_biba_cleanup_sysv_msgqueue,
-	.mpo_cleanup_sysv_sem = mac_biba_cleanup_sysv_sem,
-	.mpo_cleanup_sysv_shm = mac_biba_cleanup_sysv_shm,
-	.mpo_check_bpfdesc_receive = mac_biba_check_bpfdesc_receive,
-	.mpo_check_cred_relabel = mac_biba_check_cred_relabel,
-	.mpo_check_cred_visible = mac_biba_check_cred_visible,
-	.mpo_check_ifnet_relabel = mac_biba_check_ifnet_relabel,
-	.mpo_check_ifnet_transmit = mac_biba_check_ifnet_transmit,
-	.mpo_check_inpcb_deliver = mac_biba_check_inpcb_deliver,
-	.mpo_check_sysv_msgrcv = mac_biba_check_sysv_msgrcv,
-	.mpo_check_sysv_msgrmid = mac_biba_check_sysv_msgrmid,
-	.mpo_check_sysv_msqget = mac_biba_check_sysv_msqget,
-	.mpo_check_sysv_msqsnd = mac_biba_check_sysv_msqsnd,
-	.mpo_check_sysv_msqrcv = mac_biba_check_sysv_msqrcv,
-	.mpo_check_sysv_msqctl = mac_biba_check_sysv_msqctl,
-	.mpo_check_sysv_semctl = mac_biba_check_sysv_semctl,
-	.mpo_check_sysv_semget = mac_biba_check_sysv_semget,
-	.mpo_check_sysv_semop = mac_biba_check_sysv_semop,
-	.mpo_check_sysv_shmat = mac_biba_check_sysv_shmat,
-	.mpo_check_sysv_shmctl = mac_biba_check_sysv_shmctl,
-	.mpo_check_sysv_shmget = mac_biba_check_sysv_shmget,
-	.mpo_check_kld_load = mac_biba_check_kld_load,
-	.mpo_check_mount_stat = mac_biba_check_mount_stat,
-	.mpo_check_pipe_ioctl = mac_biba_check_pipe_ioctl,
-	.mpo_check_pipe_poll = mac_biba_check_pipe_poll,
-	.mpo_check_pipe_read = mac_biba_check_pipe_read,
-	.mpo_check_pipe_relabel = mac_biba_check_pipe_relabel,
-	.mpo_check_pipe_stat = mac_biba_check_pipe_stat,
-	.mpo_check_pipe_write = mac_biba_check_pipe_write,
-	.mpo_check_posix_sem_destroy = mac_biba_check_posix_sem_write,
-	.mpo_check_posix_sem_getvalue = mac_biba_check_posix_sem_rdonly,
-	.mpo_check_posix_sem_open = mac_biba_check_posix_sem_write,
-	.mpo_check_posix_sem_post = mac_biba_check_posix_sem_write,
-	.mpo_check_posix_sem_unlink = mac_biba_check_posix_sem_write,
-	.mpo_check_posix_sem_wait = mac_biba_check_posix_sem_write,
-	.mpo_check_proc_debug = mac_biba_check_proc_debug,
-	.mpo_check_proc_sched = mac_biba_check_proc_sched,
-	.mpo_check_proc_signal = mac_biba_check_proc_signal,
-	.mpo_check_socket_deliver = mac_biba_check_socket_deliver,
-	.mpo_check_socket_relabel = mac_biba_check_socket_relabel,
-	.mpo_check_socket_visible = mac_biba_check_socket_visible,
-	.mpo_check_system_acct = mac_biba_check_system_acct,
-	.mpo_check_system_auditctl = mac_biba_check_system_auditctl,
-	.mpo_check_system_auditon = mac_biba_check_system_auditon,
-	.mpo_check_system_swapon = mac_biba_check_system_swapon,
-	.mpo_check_system_swapoff = mac_biba_check_system_swapoff,
-	.mpo_check_system_sysctl = mac_biba_check_system_sysctl,
-	.mpo_check_vnode_access = mac_biba_check_vnode_open,
-	.mpo_check_vnode_chdir = mac_biba_check_vnode_chdir,
-	.mpo_check_vnode_chroot = mac_biba_check_vnode_chroot,
-	.mpo_check_vnode_create = mac_biba_check_vnode_create,
-	.mpo_check_vnode_deleteacl = mac_biba_check_vnode_deleteacl,
-	.mpo_check_vnode_deleteextattr = mac_biba_check_vnode_deleteextattr,
-	.mpo_check_vnode_exec = mac_biba_check_vnode_exec,
-	.mpo_check_vnode_getacl = mac_biba_check_vnode_getacl,
-	.mpo_check_vnode_getextattr = mac_biba_check_vnode_getextattr,
-	.mpo_check_vnode_link = mac_biba_check_vnode_link,
-	.mpo_check_vnode_listextattr = mac_biba_check_vnode_listextattr,
-	.mpo_check_vnode_lookup = mac_biba_check_vnode_lookup,
-	.mpo_check_vnode_mmap = mac_biba_check_vnode_mmap,
-	.mpo_check_vnode_open = mac_biba_check_vnode_open,
-	.mpo_check_vnode_poll = mac_biba_check_vnode_poll,
-	.mpo_check_vnode_read = mac_biba_check_vnode_read,
-	.mpo_check_vnode_readdir = mac_biba_check_vnode_readdir,
-	.mpo_check_vnode_readlink = mac_biba_check_vnode_readlink,
-	.mpo_check_vnode_relabel = mac_biba_check_vnode_relabel,
-	.mpo_check_vnode_rename_from = mac_biba_check_vnode_rename_from,
-	.mpo_check_vnode_rename_to = mac_biba_check_vnode_rename_to,
-	.mpo_check_vnode_revoke = mac_biba_check_vnode_revoke,
-	.mpo_check_vnode_setacl = mac_biba_check_vnode_setacl,
-	.mpo_check_vnode_setextattr = mac_biba_check_vnode_setextattr,
-	.mpo_check_vnode_setflags = mac_biba_check_vnode_setflags,
-	.mpo_check_vnode_setmode = mac_biba_check_vnode_setmode,
-	.mpo_check_vnode_setowner = mac_biba_check_vnode_setowner,
-	.mpo_check_vnode_setutimes = mac_biba_check_vnode_setutimes,
-	.mpo_check_vnode_stat = mac_biba_check_vnode_stat,
-	.mpo_check_vnode_unlink = mac_biba_check_vnode_unlink,
-	.mpo_check_vnode_write = mac_biba_check_vnode_write,
-	.mpo_associate_nfsd_label = mac_biba_associate_nfsd_label,
-	.mpo_create_mbuf_from_firewall = mac_biba_create_mbuf_from_firewall,
-	.mpo_priv_check = mac_biba_priv_check,
+	.mpo_init = biba_init,
+	.mpo_init_bpfdesc_label = biba_init_label,
+	.mpo_init_cred_label = biba_init_label,
+	.mpo_init_devfs_label = biba_init_label,
+	.mpo_init_ifnet_label = biba_init_label,
+	.mpo_init_inpcb_label = biba_init_label_waitcheck,
+	.mpo_init_syncache_label = biba_init_label_waitcheck,
+	.mpo_init_sysv_msgmsg_label = biba_init_label,
+	.mpo_init_sysv_msgqueue_label = biba_init_label,
+	.mpo_init_sysv_sem_label = biba_init_label,
+	.mpo_init_sysv_shm_label = biba_init_label,
+	.mpo_init_ipq_label = biba_init_label_waitcheck,
+	.mpo_init_mbuf_label = biba_init_label_waitcheck,
+	.mpo_init_mount_label = biba_init_label,
+	.mpo_init_pipe_label = biba_init_label,
+	.mpo_init_posix_sem_label = biba_init_label,
+	.mpo_init_socket_label = biba_init_label_waitcheck,
+	.mpo_init_socket_peer_label = biba_init_label_waitcheck,
+	.mpo_init_syncache_from_inpcb = biba_init_syncache_from_inpcb,
+	.mpo_init_vnode_label = biba_init_label,
+	.mpo_destroy_bpfdesc_label = biba_destroy_label,
+	.mpo_destroy_cred_label = biba_destroy_label,
+	.mpo_destroy_devfs_label = biba_destroy_label,
+	.mpo_destroy_ifnet_label = biba_destroy_label,
+	.mpo_destroy_inpcb_label = biba_destroy_label,
+	.mpo_destroy_syncache_label = biba_destroy_label,
+	.mpo_destroy_sysv_msgmsg_label = biba_destroy_label,
+	.mpo_destroy_sysv_msgqueue_label = biba_destroy_label,
+	.mpo_destroy_sysv_sem_label = biba_destroy_label,
+	.mpo_destroy_sysv_shm_label = biba_destroy_label,
+	.mpo_destroy_ipq_label = biba_destroy_label,
+	.mpo_destroy_mbuf_label = biba_destroy_label,
+	.mpo_destroy_mount_label = biba_destroy_label,
+	.mpo_destroy_pipe_label = biba_destroy_label,
+	.mpo_destroy_posix_sem_label = biba_destroy_label,
+	.mpo_destroy_socket_label = biba_destroy_label,
+	.mpo_destroy_socket_peer_label = biba_destroy_label,
+	.mpo_destroy_vnode_label = biba_destroy_label,
+	.mpo_copy_cred_label = biba_copy_label,
+	.mpo_copy_ifnet_label = biba_copy_label,
+	.mpo_copy_mbuf_label = biba_copy_label,
+	.mpo_copy_pipe_label = biba_copy_label,
+	.mpo_copy_socket_label = biba_copy_label,
+	.mpo_copy_vnode_label = biba_copy_label,
+	.mpo_externalize_cred_label = biba_externalize_label,
+	.mpo_externalize_ifnet_label = biba_externalize_label,
+	.mpo_externalize_pipe_label = biba_externalize_label,
+	.mpo_externalize_socket_label = biba_externalize_label,
+	.mpo_externalize_socket_peer_label = biba_externalize_label,
+	.mpo_externalize_vnode_label = biba_externalize_label,
+	.mpo_internalize_cred_label = biba_internalize_label,
+	.mpo_internalize_ifnet_label = biba_internalize_label,
+	.mpo_internalize_pipe_label = biba_internalize_label,
+	.mpo_internalize_socket_label = biba_internalize_label,
+	.mpo_internalize_vnode_label = biba_internalize_label,
+	.mpo_create_devfs_device = biba_create_devfs_device,
+	.mpo_create_devfs_directory = biba_create_devfs_directory,
+	.mpo_create_devfs_symlink = biba_create_devfs_symlink,
+	.mpo_create_mount = biba_create_mount,
+	.mpo_relabel_vnode = biba_relabel_vnode,
+	.mpo_update_devfs = biba_update_devfs,
+	.mpo_associate_vnode_devfs = biba_associate_vnode_devfs,
+	.mpo_associate_vnode_extattr = biba_associate_vnode_extattr,
+	.mpo_associate_vnode_singlelabel = biba_associate_vnode_singlelabel,
+	.mpo_create_vnode_extattr = biba_create_vnode_extattr,
+	.mpo_setlabel_vnode_extattr = biba_setlabel_vnode_extattr,
+	.mpo_create_mbuf_from_socket = biba_create_mbuf_from_socket,
+	.mpo_create_mbuf_from_syncache = biba_create_mbuf_from_syncache,
+	.mpo_create_pipe = biba_create_pipe,
+	.mpo_create_posix_sem = biba_create_posix_sem,
+	.mpo_create_socket = biba_create_socket,
+	.mpo_create_socket_from_socket = biba_create_socket_from_socket,
+	.mpo_relabel_pipe = biba_relabel_pipe,
+	.mpo_relabel_socket = biba_relabel_socket,
+	.mpo_set_socket_peer_from_mbuf = biba_set_socket_peer_from_mbuf,
+	.mpo_set_socket_peer_from_socket = biba_set_socket_peer_from_socket,
+	.mpo_create_bpfdesc = biba_create_bpfdesc,
+	.mpo_create_datagram_from_ipq = biba_create_datagram_from_ipq,
+	.mpo_create_fragment = biba_create_fragment,
+	.mpo_create_ifnet = biba_create_ifnet,
+	.mpo_create_inpcb_from_socket = biba_create_inpcb_from_socket,
+	.mpo_create_sysv_msgmsg = biba_create_sysv_msgmsg,
+	.mpo_create_sysv_msgqueue = biba_create_sysv_msgqueue,
+	.mpo_create_sysv_sem = biba_create_sysv_sem,
+	.mpo_create_sysv_shm = biba_create_sysv_shm,
+	.mpo_create_ipq = biba_create_ipq,
+	.mpo_create_mbuf_from_inpcb = biba_create_mbuf_from_inpcb,
+	.mpo_create_mbuf_linklayer = biba_create_mbuf_linklayer,
+	.mpo_create_mbuf_from_bpfdesc = biba_create_mbuf_from_bpfdesc,
+	.mpo_create_mbuf_from_ifnet = biba_create_mbuf_from_ifnet,
+	.mpo_create_mbuf_multicast_encap = biba_create_mbuf_multicast_encap,
+	.mpo_create_mbuf_netlayer = biba_create_mbuf_netlayer,
+	.mpo_fragment_match = biba_fragment_match,
+	.mpo_relabel_ifnet = biba_relabel_ifnet,
+	.mpo_update_ipq = biba_update_ipq,
+	.mpo_inpcb_sosetlabel = biba_inpcb_sosetlabel,
+	.mpo_create_proc0 = biba_create_proc0,
+	.mpo_create_proc1 = biba_create_proc1,
+	.mpo_relabel_cred = biba_relabel_cred,
+	.mpo_cleanup_sysv_msgmsg = biba_cleanup_sysv_msgmsg,
+	.mpo_cleanup_sysv_msgqueue = biba_cleanup_sysv_msgqueue,
+	.mpo_cleanup_sysv_sem = biba_cleanup_sysv_sem,
+	.mpo_cleanup_sysv_shm = biba_cleanup_sysv_shm,
+	.mpo_check_bpfdesc_receive = biba_check_bpfdesc_receive,
+	.mpo_check_cred_relabel = biba_check_cred_relabel,
+	.mpo_check_cred_visible = biba_check_cred_visible,
+	.mpo_check_ifnet_relabel = biba_check_ifnet_relabel,
+	.mpo_check_ifnet_transmit = biba_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = biba_check_inpcb_deliver,
+	.mpo_check_sysv_msgrcv = biba_check_sysv_msgrcv,
+	.mpo_check_sysv_msgrmid = biba_check_sysv_msgrmid,
+	.mpo_check_sysv_msqget = biba_check_sysv_msqget,
+	.mpo_check_sysv_msqsnd = biba_check_sysv_msqsnd,
+	.mpo_check_sysv_msqrcv = biba_check_sysv_msqrcv,
+	.mpo_check_sysv_msqctl = biba_check_sysv_msqctl,
+	.mpo_check_sysv_semctl = biba_check_sysv_semctl,
+	.mpo_check_sysv_semget = biba_check_sysv_semget,
+	.mpo_check_sysv_semop = biba_check_sysv_semop,
+	.mpo_check_sysv_shmat = biba_check_sysv_shmat,
+	.mpo_check_sysv_shmctl = biba_check_sysv_shmctl,
+	.mpo_check_sysv_shmget = biba_check_sysv_shmget,
+	.mpo_check_kld_load = biba_check_kld_load,
+	.mpo_check_mount_stat = biba_check_mount_stat,
+	.mpo_check_pipe_ioctl = biba_check_pipe_ioctl,
+	.mpo_check_pipe_poll = biba_check_pipe_poll,
+	.mpo_check_pipe_read = biba_check_pipe_read,
+	.mpo_check_pipe_relabel = biba_check_pipe_relabel,
+	.mpo_check_pipe_stat = biba_check_pipe_stat,
+	.mpo_check_pipe_write = biba_check_pipe_write,
+	.mpo_check_posix_sem_destroy = biba_check_posix_sem_write,
+	.mpo_check_posix_sem_getvalue = biba_check_posix_sem_rdonly,
+	.mpo_check_posix_sem_open = biba_check_posix_sem_write,
+	.mpo_check_posix_sem_post = biba_check_posix_sem_write,
+	.mpo_check_posix_sem_unlink = biba_check_posix_sem_write,
+	.mpo_check_posix_sem_wait = biba_check_posix_sem_write,
+	.mpo_check_proc_debug = biba_check_proc_debug,
+	.mpo_check_proc_sched = biba_check_proc_sched,
+	.mpo_check_proc_signal = biba_check_proc_signal,
+	.mpo_check_socket_deliver = biba_check_socket_deliver,
+	.mpo_check_socket_relabel = biba_check_socket_relabel,
+	.mpo_check_socket_visible = biba_check_socket_visible,
+	.mpo_check_system_acct = biba_check_system_acct,
+	.mpo_check_system_auditctl = biba_check_system_auditctl,
+	.mpo_check_system_auditon = biba_check_system_auditon,
+	.mpo_check_system_swapon = biba_check_system_swapon,
+	.mpo_check_system_swapoff = biba_check_system_swapoff,
+	.mpo_check_system_sysctl = biba_check_system_sysctl,
+	.mpo_check_vnode_access = biba_check_vnode_open,
+	.mpo_check_vnode_chdir = biba_check_vnode_chdir,
+	.mpo_check_vnode_chroot = biba_check_vnode_chroot,
+	.mpo_check_vnode_create = biba_check_vnode_create,
+	.mpo_check_vnode_deleteacl = biba_check_vnode_deleteacl,
+	.mpo_check_vnode_deleteextattr = biba_check_vnode_deleteextattr,
+	.mpo_check_vnode_exec = biba_check_vnode_exec,
+	.mpo_check_vnode_getacl = biba_check_vnode_getacl,
+	.mpo_check_vnode_getextattr = biba_check_vnode_getextattr,
+	.mpo_check_vnode_link = biba_check_vnode_link,
+	.mpo_check_vnode_listextattr = biba_check_vnode_listextattr,
+	.mpo_check_vnode_lookup = biba_check_vnode_lookup,
+	.mpo_check_vnode_mmap = biba_check_vnode_mmap,
+	.mpo_check_vnode_open = biba_check_vnode_open,
+	.mpo_check_vnode_poll = biba_check_vnode_poll,
+	.mpo_check_vnode_read = biba_check_vnode_read,
+	.mpo_check_vnode_readdir = biba_check_vnode_readdir,
+	.mpo_check_vnode_readlink = biba_check_vnode_readlink,
+	.mpo_check_vnode_relabel = biba_check_vnode_relabel,
+	.mpo_check_vnode_rename_from = biba_check_vnode_rename_from,
+	.mpo_check_vnode_rename_to = biba_check_vnode_rename_to,
+	.mpo_check_vnode_revoke = biba_check_vnode_revoke,
+	.mpo_check_vnode_setacl = biba_check_vnode_setacl,
+	.mpo_check_vnode_setextattr = biba_check_vnode_setextattr,
+	.mpo_check_vnode_setflags = biba_check_vnode_setflags,
+	.mpo_check_vnode_setmode = biba_check_vnode_setmode,
+	.mpo_check_vnode_setowner = biba_check_vnode_setowner,
+	.mpo_check_vnode_setutimes = biba_check_vnode_setutimes,
+	.mpo_check_vnode_stat = biba_check_vnode_stat,
+	.mpo_check_vnode_unlink = biba_check_vnode_unlink,
+	.mpo_check_vnode_write = biba_check_vnode_write,
+	.mpo_associate_nfsd_label = biba_associate_nfsd_label,
+	.mpo_create_mbuf_from_firewall = biba_create_mbuf_from_firewall,
+	.mpo_priv_check = biba_priv_check,
 };
 
 MAC_POLICY_SET(&mac_biba_ops, mac_biba, "TrustedBSD MAC/Biba",
-    MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mac_biba_slot);
+    MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &biba_slot);
diff --git a/sys/security/mac_bsdextended/mac_bsdextended.c b/sys/security/mac_bsdextended/mac_bsdextended.c
index bdeadce02129..24c34440dc04 100644
--- a/sys/security/mac_bsdextended/mac_bsdextended.c
+++ b/sys/security/mac_bsdextended/mac_bsdextended.c
@@ -61,17 +61,17 @@
 #include <security/mac/mac_policy.h>
 #include <security/mac_bsdextended/mac_bsdextended.h>
 
-static struct mtx mac_bsdextended_mtx;
+static struct mtx ugidfw_mtx;
 
 SYSCTL_DECL(_security_mac);
 
 SYSCTL_NODE(_security_mac, OID_AUTO, bsdextended, CTLFLAG_RW, 0,
     "TrustedBSD extended BSD MAC policy controls");
 
-static int	mac_bsdextended_enabled = 1;
+static int	ugidfw_enabled = 1;
 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_bsdextended_enabled, 0, "Enforce extended BSD policy");
-TUNABLE_INT("security.mac.bsdextended.enabled", &mac_bsdextended_enabled);
+    &ugidfw_enabled, 0, "Enforce extended BSD policy");
+TUNABLE_INT("security.mac.bsdextended.enabled", &ugidfw_enabled);
 
 MALLOC_DEFINE(M_MACBSDEXTENDED, "mac_bsdextended", "BSD Extended MAC rule");
 
@@ -92,23 +92,22 @@ SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, rule_version, CTLFLAG_RD,
  * This is just used for logging purposes, eventually we would like to log
  * much more then failed requests.
  */
-static int mac_bsdextended_logging;
+static int ugidfw_logging;
 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, logging, CTLFLAG_RW,
-    &mac_bsdextended_logging, 0, "Log failed authorization requests");
+    &ugidfw_logging, 0, "Log failed authorization requests");
 
 /*
  * This tunable is here for compatibility.  It will allow the user to switch
  * between the new mode (first rule matches) and the old functionality (all
  * rules match).
  */
-static int
-mac_bsdextended_firstmatch_enabled;
+static int ugidfw_firstmatch_enabled;
 SYSCTL_INT(_security_mac_bsdextended, OID_AUTO, firstmatch_enabled,
-    CTLFLAG_RW, &mac_bsdextended_firstmatch_enabled, 1,
+    CTLFLAG_RW, &ugidfw_firstmatch_enabled, 1,
     "Disable/enable match first rule functionality");
 
 static int
-mac_bsdextended_rule_valid(struct mac_bsdextended_rule *rule)
+ugidfw_rule_valid(struct mac_bsdextended_rule *rule)
 {
 
 	if ((rule->mbr_subject.mbs_flags | MBS_ALL_FLAGS) != MBS_ALL_FLAGS)
@@ -152,7 +151,7 @@ sysctl_rule(SYSCTL_HANDLER_ARGS)
 		    sizeof(*ruleptr), M_MACBSDEXTENDED, M_WAITOK | M_ZERO);
 	}
 
-	mtx_lock(&mac_bsdextended_mtx);
+	mtx_lock(&ugidfw_mtx);
 	if (req->oldptr) {
 		if (index < 0 || index > rule_slots + 1) {
 			error = ENOENT;
@@ -174,7 +173,7 @@ sysctl_rule(SYSCTL_HANDLER_ARGS)
 		rule_count--;
 		rules[index] = NULL;
 	} else if (req->newptr) {
-		error = mac_bsdextended_rule_valid(&temprule);
+		error = ugidfw_rule_valid(&temprule);
 		if (error)
 			goto out;
 		if (rules[index] == NULL) {
@@ -188,7 +187,7 @@ sysctl_rule(SYSCTL_HANDLER_ARGS)
 			*rules[index] = temprule;
 	}
 out:
-	mtx_unlock(&mac_bsdextended_mtx);
+	mtx_unlock(&ugidfw_mtx);
 	if (ruleptr != NULL)
 		FREE(ruleptr, M_MACBSDEXTENDED);
 	if (req->oldptr && error == 0)
@@ -200,21 +199,21 @@ SYSCTL_NODE(_security_mac_bsdextended, OID_AUTO, rules, CTLFLAG_RW,
     sysctl_rule, "BSD extended MAC rules");
 
 static void
-mac_bsdextended_init(struct mac_policy_conf *mpc)
+ugidfw_init(struct mac_policy_conf *mpc)
 {
 
-	mtx_init(&mac_bsdextended_mtx, "mac_bsdextended lock", NULL, MTX_DEF);
+	mtx_init(&ugidfw_mtx, "mac_bsdextended lock", NULL, MTX_DEF);
 }
 
 static void
-mac_bsdextended_destroy(struct mac_policy_conf *mpc)
+ugidfw_destroy(struct mac_policy_conf *mpc)
 {
 
-	mtx_destroy(&mac_bsdextended_mtx);
+	mtx_destroy(&ugidfw_mtx);
 }
 
 static int
-mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
+ugidfw_rulecheck(struct mac_bsdextended_rule *rule,
     struct ucred *cred, struct vnode *vp, struct vattr *vap, int acc_mode)
 {
 	int match;
@@ -223,7 +222,7 @@ mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
 	/*
 	 * Is there a subject match?
 	 */
-	mtx_assert(&mac_bsdextended_mtx, MA_OWNED);
+	mtx_assert(&ugidfw_mtx, MA_OWNED);
 	if (rule->mbr_subject.mbs_flags & MBS_UID_DEFINED) {
 		match =  ((cred->cr_uid <= rule->mbr_subject.mbs_uid_max &&
 		    cred->cr_uid >= rule->mbr_subject.mbs_uid_min) ||
@@ -371,7 +370,7 @@ mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
 	 * Is the access permitted?
 	 */
 	if ((rule->mbr_mode & acc_mode) != acc_mode) {
-		if (mac_bsdextended_logging)
+		if (ugidfw_logging)
 			log(LOG_AUTHPRIV, "mac_bsdextended: %d:%d request %d"
 			    " on %d:%d failed. \n", cred->cr_ruid,
 			    cred->cr_rgid, acc_mode, vap->va_uid,
@@ -383,14 +382,14 @@ mac_bsdextended_rulecheck(struct mac_bsdextended_rule *rule,
 	 * If the rule matched, permits access, and first match is enabled,
 	 * return success.
 	 */
-	if (mac_bsdextended_firstmatch_enabled)
+	if (ugidfw_firstmatch_enabled)
 		return (EJUSTRETURN);
 	else
 		return (0);
 }
 
 static int
-mac_bsdextended_check(struct ucred *cred, struct vnode *vp, struct vattr *vap,
+ugidfw_check(struct ucred *cred, struct vnode *vp, struct vattr *vap,
     int acc_mode)
 {
 	int error, i;
@@ -408,341 +407,341 @@ mac_bsdextended_check(struct ucred *cred, struct vnode *vp, struct vattr *vap,
 		acc_mode &= ~MBI_APPEND;
 		acc_mode |= MBI_WRITE;
 	}
-	mtx_lock(&mac_bsdextended_mtx);
+	mtx_lock(&ugidfw_mtx);
 	for (i = 0; i < rule_slots; i++) {
 		if (rules[i] == NULL)
 			continue;
-		error = mac_bsdextended_rulecheck(rules[i], cred,
+		error = ugidfw_rulecheck(rules[i], cred,
 		    vp, vap, acc_mode);
 		if (error == EJUSTRETURN)
 			break;
 		if (error) {
-			mtx_unlock(&mac_bsdextended_mtx);
+			mtx_unlock(&ugidfw_mtx);
 			return (error);
 		}
 	}
-	mtx_unlock(&mac_bsdextended_mtx);
+	mtx_unlock(&ugidfw_mtx);
 	return (0);
 }
 
 static int
-mac_bsdextended_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode)
+ugidfw_check_vp(struct ucred *cred, struct vnode *vp, int acc_mode)
 {
 	int error;
 	struct vattr vap;
 
-	if (!mac_bsdextended_enabled)
+	if (!ugidfw_enabled)
 		return (0);
 	error = VOP_GETATTR(vp, &vap, cred, curthread);
 	if (error)
 		return (error);
-	return (mac_bsdextended_check(cred, vp, &vap, acc_mode));
+	return (ugidfw_check(cred, vp, &vap, acc_mode));
 }
 
 static int
-mac_bsdextended_check_system_acct(struct ucred *cred, struct vnode *vp,
+ugidfw_check_system_acct(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_system_auditctl(struct ucred *cred, struct vnode *vp,
+ugidfw_check_system_auditctl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_system_swapoff(struct ucred *cred, struct vnode *vp,
+ugidfw_check_system_swapoff(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_system_swapon(struct ucred *cred, struct vnode *vp,
+ugidfw_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_vnode_access(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_access(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int acc_mode)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, acc_mode));
+	return (ugidfw_check_vp(cred, vp, acc_mode));
 }
 
 static int
-mac_bsdextended_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, dvp, MBI_EXEC));
+	return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
 }
 
 static int
-mac_bsdextended_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, dvp, MBI_EXEC));
+	return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
 }
 
 static int
-mac_bsdextended_check_create_vnode(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_create_vnode(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
 {
 
-	return (mac_bsdextended_check_vp(cred, dvp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, dvp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
+	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
 }
 
 static int
-mac_bsdextended_check_vnode_deleteextattr(struct ucred *cred,
+ugidfw_check_vnode_deleteextattr(struct ucred *cred,
     struct vnode *vp, struct label *vplabel, int attrnamespace,
     const char *name)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_vnode_exec(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_exec(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct image_params *imgp,
     struct label *execlabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_READ|MBI_EXEC));
+	return (ugidfw_check_vp(cred, vp, MBI_READ|MBI_EXEC));
 }
 
 static int
-mac_bsdextended_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_STAT));
+	return (ugidfw_check_vp(cred, vp, MBI_STAT));
 }
 
 static int
-mac_bsdextended_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_READ));
+	return (ugidfw_check_vp(cred, vp, MBI_READ));
 }
 
 static int
-mac_bsdextended_check_vnode_link(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_link(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *label,
     struct componentname *cnp)
 {
 	int error;
 
-	error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
+	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
 	if (error)
 		return (error);
-	error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE);
+	error = ugidfw_check_vp(cred, vp, MBI_WRITE);
 	if (error)
 		return (error);
 	return (0);
 }
 
 static int
-mac_bsdextended_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_READ));
+	return (ugidfw_check_vp(cred, vp, MBI_READ));
 }
 
 static int
-mac_bsdextended_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp)
 {
 
-	return (mac_bsdextended_check_vp(cred, dvp, MBI_EXEC));
+	return (ugidfw_check_vp(cred, dvp, MBI_EXEC));
 }
 
 static int
-mac_bsdextended_check_vnode_open(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_open(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int acc_mode)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, acc_mode));
+	return (ugidfw_check_vp(cred, vp, acc_mode));
 }
 
 static int
-mac_bsdextended_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, dvp, MBI_READ));
+	return (ugidfw_check_vp(cred, dvp, MBI_READ));
 }
 
 static int
-mac_bsdextended_check_vnode_readdlink(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_readdlink(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_READ));
+	return (ugidfw_check_vp(cred, vp, MBI_READ));
 }
 
 static int
-mac_bsdextended_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	int error;
 
-	error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
+	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
 	if (error)
 		return (error);
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     int samedir, struct componentname *cnp)
 {
 	int error;
 
-	error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
+	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
 	if (error)
 		return (error);
 	if (vp != NULL)
-		error = mac_bsdextended_check_vp(cred, vp, MBI_WRITE);
+		error = ugidfw_check_vp(cred, vp, MBI_WRITE);
 	return (error);
 }
 
 static int
-mac_bsdextended_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
+	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
 }
 
 static int
-mac_bsdextended_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
+ugidfw_check_setacl_vnode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type, struct acl *acl)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
+	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
 }
 
 static int
-mac_bsdextended_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
 }
 
 static int
-mac_bsdextended_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, u_long flags)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
+	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
 }
 
 static int
-mac_bsdextended_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, mode_t mode)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
+	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
 }
 
 static int
-mac_bsdextended_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, uid_t uid, gid_t gid)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
+	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
 }
 
 static int
-mac_bsdextended_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+ugidfw_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct timespec atime, struct timespec utime)
 {
 
-	return (mac_bsdextended_check_vp(cred, vp, MBI_ADMIN));
+	return (ugidfw_check_vp(cred, vp, MBI_ADMIN));
 }
 
 static int
-mac_bsdextended_check_vnode_stat(struct ucred *active_cred,
+ugidfw_check_vnode_stat(struct ucred *active_cred,
     struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
 {
 
-	return (mac_bsdextended_check_vp(active_cred, vp, MBI_STAT));
+	return (ugidfw_check_vp(active_cred, vp, MBI_STAT));
 }
 
 static int
-mac_bsdextended_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
+ugidfw_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	int error;
 
-	error = mac_bsdextended_check_vp(cred, dvp, MBI_WRITE);
+	error = ugidfw_check_vp(cred, dvp, MBI_WRITE);
 	if (error)
 		return (error);
-	return (mac_bsdextended_check_vp(cred, vp, MBI_WRITE));
-}
-
-static struct mac_policy_ops mac_bsdextended_ops =
-{
-	.mpo_destroy = mac_bsdextended_destroy,
-	.mpo_init = mac_bsdextended_init,
-	.mpo_check_system_acct = mac_bsdextended_check_system_acct,
-	.mpo_check_system_auditctl = mac_bsdextended_check_system_auditctl,
-	.mpo_check_system_swapoff = mac_bsdextended_check_system_swapoff,
-	.mpo_check_system_swapon = mac_bsdextended_check_system_swapon,
-	.mpo_check_vnode_access = mac_bsdextended_check_vnode_access,
-	.mpo_check_vnode_chdir = mac_bsdextended_check_vnode_chdir,
-	.mpo_check_vnode_chroot = mac_bsdextended_check_vnode_chroot,
-	.mpo_check_vnode_create = mac_bsdextended_check_create_vnode,
-	.mpo_check_vnode_deleteacl = mac_bsdextended_check_vnode_deleteacl,
-	.mpo_check_vnode_deleteextattr = mac_bsdextended_check_vnode_deleteextattr,
-	.mpo_check_vnode_exec = mac_bsdextended_check_vnode_exec,
-	.mpo_check_vnode_getacl = mac_bsdextended_check_vnode_getacl,
-	.mpo_check_vnode_getextattr = mac_bsdextended_check_vnode_getextattr,
-	.mpo_check_vnode_link = mac_bsdextended_check_vnode_link,
-	.mpo_check_vnode_listextattr = mac_bsdextended_check_vnode_listextattr,
-	.mpo_check_vnode_lookup = mac_bsdextended_check_vnode_lookup,
-	.mpo_check_vnode_open = mac_bsdextended_check_vnode_open,
-	.mpo_check_vnode_readdir = mac_bsdextended_check_vnode_readdir,
-	.mpo_check_vnode_readlink = mac_bsdextended_check_vnode_readdlink,
-	.mpo_check_vnode_rename_from = mac_bsdextended_check_vnode_rename_from,
-	.mpo_check_vnode_rename_to = mac_bsdextended_check_vnode_rename_to,
-	.mpo_check_vnode_revoke = mac_bsdextended_check_vnode_revoke,
-	.mpo_check_vnode_setacl = mac_bsdextended_check_setacl_vnode,
-	.mpo_check_vnode_setextattr = mac_bsdextended_check_vnode_setextattr,
-	.mpo_check_vnode_setflags = mac_bsdextended_check_vnode_setflags,
-	.mpo_check_vnode_setmode = mac_bsdextended_check_vnode_setmode,
-	.mpo_check_vnode_setowner = mac_bsdextended_check_vnode_setowner,
-	.mpo_check_vnode_setutimes = mac_bsdextended_check_vnode_setutimes,
-	.mpo_check_vnode_stat = mac_bsdextended_check_vnode_stat,
-	.mpo_check_vnode_unlink = mac_bsdextended_check_vnode_unlink,
+	return (ugidfw_check_vp(cred, vp, MBI_WRITE));
+}
+
+static struct mac_policy_ops ugidfw_ops =
+{
+	.mpo_destroy = ugidfw_destroy,
+	.mpo_init = ugidfw_init,
+	.mpo_check_system_acct = ugidfw_check_system_acct,
+	.mpo_check_system_auditctl = ugidfw_check_system_auditctl,
+	.mpo_check_system_swapoff = ugidfw_check_system_swapoff,
+	.mpo_check_system_swapon = ugidfw_check_system_swapon,
+	.mpo_check_vnode_access = ugidfw_check_vnode_access,
+	.mpo_check_vnode_chdir = ugidfw_check_vnode_chdir,
+	.mpo_check_vnode_chroot = ugidfw_check_vnode_chroot,
+	.mpo_check_vnode_create = ugidfw_check_create_vnode,
+	.mpo_check_vnode_deleteacl = ugidfw_check_vnode_deleteacl,
+	.mpo_check_vnode_deleteextattr = ugidfw_check_vnode_deleteextattr,
+	.mpo_check_vnode_exec = ugidfw_check_vnode_exec,
+	.mpo_check_vnode_getacl = ugidfw_check_vnode_getacl,
+	.mpo_check_vnode_getextattr = ugidfw_check_vnode_getextattr,
+	.mpo_check_vnode_link = ugidfw_check_vnode_link,
+	.mpo_check_vnode_listextattr = ugidfw_check_vnode_listextattr,
+	.mpo_check_vnode_lookup = ugidfw_check_vnode_lookup,
+	.mpo_check_vnode_open = ugidfw_check_vnode_open,
+	.mpo_check_vnode_readdir = ugidfw_check_vnode_readdir,
+	.mpo_check_vnode_readlink = ugidfw_check_vnode_readdlink,
+	.mpo_check_vnode_rename_from = ugidfw_check_vnode_rename_from,
+	.mpo_check_vnode_rename_to = ugidfw_check_vnode_rename_to,
+	.mpo_check_vnode_revoke = ugidfw_check_vnode_revoke,
+	.mpo_check_vnode_setacl = ugidfw_check_setacl_vnode,
+	.mpo_check_vnode_setextattr = ugidfw_check_vnode_setextattr,
+	.mpo_check_vnode_setflags = ugidfw_check_vnode_setflags,
+	.mpo_check_vnode_setmode = ugidfw_check_vnode_setmode,
+	.mpo_check_vnode_setowner = ugidfw_check_vnode_setowner,
+	.mpo_check_vnode_setutimes = ugidfw_check_vnode_setutimes,
+	.mpo_check_vnode_stat = ugidfw_check_vnode_stat,
+	.mpo_check_vnode_unlink = ugidfw_check_vnode_unlink,
 };
 
-MAC_POLICY_SET(&mac_bsdextended_ops, mac_bsdextended,
-    "TrustedBSD MAC/BSD Extended", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
+MAC_POLICY_SET(&ugidfw_ops, mac_bsdextended, "TrustedBSD MAC/BSD Extended",
+    MPC_LOADTIME_FLAG_UNLOADOK, NULL);
diff --git a/sys/security/mac_ifoff/mac_ifoff.c b/sys/security/mac_ifoff/mac_ifoff.c
index 412a547940b9..59db846e960b 100644
--- a/sys/security/mac_ifoff/mac_ifoff.c
+++ b/sys/security/mac_ifoff/mac_ifoff.c
@@ -36,6 +36,7 @@
 
 /*
  * Developed by the TrustedBSD Project.
+ *
  * Limit access to interfaces until they are specifically administratively
  * enabled.  Prevents protocol stack-driven packet leakage in unsafe
  * environments.
@@ -57,38 +58,38 @@ SYSCTL_DECL(_security_mac);
 SYSCTL_NODE(_security_mac, OID_AUTO, ifoff, CTLFLAG_RW, 0,
     "TrustedBSD mac_ifoff policy controls");
 
-static int	mac_ifoff_enabled = 1;
+static int	ifoff_enabled = 1;
 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_ifoff_enabled, 0, "Enforce ifoff policy");
-TUNABLE_INT("security.mac.ifoff.enabled", &mac_ifoff_enabled);
+    &ifoff_enabled, 0, "Enforce ifoff policy");
+TUNABLE_INT("security.mac.ifoff.enabled", &ifoff_enabled);
 
-static int	mac_ifoff_lo_enabled = 1;
+static int	ifoff_lo_enabled = 1;
 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, lo_enabled, CTLFLAG_RW,
-    &mac_ifoff_lo_enabled, 0, "Enable loopback interfaces");
-TUNABLE_INT("security.mac.ifoff.lo_enabled", &mac_ifoff_lo_enabled);
+    &ifoff_lo_enabled, 0, "Enable loopback interfaces");
+TUNABLE_INT("security.mac.ifoff.lo_enabled", &ifoff_lo_enabled);
 
-static int	mac_ifoff_other_enabled = 0;
+static int	ifoff_other_enabled = 0;
 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, other_enabled, CTLFLAG_RW,
-    &mac_ifoff_other_enabled, 0, "Enable other interfaces");
-TUNABLE_INT("security.mac.ifoff.other_enabled", &mac_ifoff_other_enabled);
+    &ifoff_other_enabled, 0, "Enable other interfaces");
+TUNABLE_INT("security.mac.ifoff.other_enabled", &ifoff_other_enabled);
 
-static int	mac_ifoff_bpfrecv_enabled = 0;
+static int	ifoff_bpfrecv_enabled = 0;
 SYSCTL_INT(_security_mac_ifoff, OID_AUTO, bpfrecv_enabled, CTLFLAG_RW,
-    &mac_ifoff_bpfrecv_enabled, 0, "Enable BPF reception even when interface "
+    &ifoff_bpfrecv_enabled, 0, "Enable BPF reception even when interface "
     "is disabled");
-TUNABLE_INT("security.mac.ifoff.bpfrecv.enabled", &mac_ifoff_bpfrecv_enabled);
+TUNABLE_INT("security.mac.ifoff.bpfrecv.enabled", &ifoff_bpfrecv_enabled);
 
 static int
 check_ifnet_outgoing(struct ifnet *ifp)
 {
 
-	if (!mac_ifoff_enabled)
+	if (!ifoff_enabled)
 		return (0);
 
-	if (mac_ifoff_lo_enabled && ifp->if_type == IFT_LOOP)
+	if (ifoff_lo_enabled && ifp->if_type == IFT_LOOP)
 		return (0);
 
-	if (mac_ifoff_other_enabled && ifp->if_type != IFT_LOOP)
+	if (ifoff_other_enabled && ifp->if_type != IFT_LOOP)
 		return (0);
 
 	return (EPERM);
@@ -97,23 +98,23 @@ check_ifnet_outgoing(struct ifnet *ifp)
 static int
 check_ifnet_incoming(struct ifnet *ifp, int viabpf)
 {
-	if (!mac_ifoff_enabled)
+	if (!ifoff_enabled)
 		return (0);
 
-	if (mac_ifoff_lo_enabled && ifp->if_type == IFT_LOOP)
+	if (ifoff_lo_enabled && ifp->if_type == IFT_LOOP)
 		return (0);
 
-	if (mac_ifoff_other_enabled && ifp->if_type != IFT_LOOP)
+	if (ifoff_other_enabled && ifp->if_type != IFT_LOOP)
 		return (0);
 
-	if (viabpf && mac_ifoff_bpfrecv_enabled)
+	if (viabpf && ifoff_bpfrecv_enabled)
 		return (0);
 
 	return (EPERM);
 }
 
 static int
-mac_ifoff_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
+ifoff_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
     struct ifnet *ifp, struct label *ifplabel)
 {
 
@@ -121,7 +122,7 @@ mac_ifoff_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
 }
 
 static int
-mac_ifoff_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
+ifoff_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 
@@ -129,7 +130,7 @@ mac_ifoff_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
 }
 
 static int
-mac_ifoff_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+ifoff_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 
@@ -141,7 +142,7 @@ mac_ifoff_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
 }
 
 static int
-mac_ifoff_check_socket_deliver(struct socket *so, struct label *solabel,
+ifoff_check_socket_deliver(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 
@@ -152,13 +153,13 @@ mac_ifoff_check_socket_deliver(struct socket *so, struct label *solabel,
 	return (0);
 }
 
-static struct mac_policy_ops mac_ifoff_ops =
+static struct mac_policy_ops ifoff_ops =
 {
-	.mpo_check_bpfdesc_receive = mac_ifoff_check_bpfdesc_receive,
-	.mpo_check_ifnet_transmit = mac_ifoff_check_ifnet_transmit,
-	.mpo_check_inpcb_deliver = mac_ifoff_check_inpcb_deliver,
-	.mpo_check_socket_deliver = mac_ifoff_check_socket_deliver,
+	.mpo_check_bpfdesc_receive = ifoff_check_bpfdesc_receive,
+	.mpo_check_ifnet_transmit = ifoff_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = ifoff_check_inpcb_deliver,
+	.mpo_check_socket_deliver = ifoff_check_socket_deliver,
 };
 
-MAC_POLICY_SET(&mac_ifoff_ops, mac_ifoff, "TrustedBSD MAC/ifoff",
+MAC_POLICY_SET(&ifoff_ops, mac_ifoff, "TrustedBSD MAC/ifoff",
     MPC_LOADTIME_FLAG_UNLOADOK, NULL);
diff --git a/sys/security/mac_lomac/mac_lomac.c b/sys/security/mac_lomac/mac_lomac.c
index 2186b97bbffd..8c2ca0ff3215 100644
--- a/sys/security/mac_lomac/mac_lomac.c
+++ b/sys/security/mac_lomac/mac_lomac.c
@@ -92,14 +92,14 @@ SYSCTL_DECL(_security_mac);
 SYSCTL_NODE(_security_mac, OID_AUTO, lomac, CTLFLAG_RW, 0,
     "TrustedBSD mac_lomac policy controls");
 
-static int	mac_lomac_label_size = sizeof(struct mac_lomac);
+static int	lomac_label_size = sizeof(struct mac_lomac);
 SYSCTL_INT(_security_mac_lomac, OID_AUTO, label_size, CTLFLAG_RD,
-    &mac_lomac_label_size, 0, "Size of struct mac_lomac");
+    &lomac_label_size, 0, "Size of struct mac_lomac");
 
-static int	mac_lomac_enabled = 1;
+static int	lomac_enabled = 1;
 SYSCTL_INT(_security_mac_lomac, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_lomac_enabled, 0, "Enforce MAC/LOMAC policy");
-TUNABLE_INT("security.mac.lomac.enabled", &mac_lomac_enabled);
+    &lomac_enabled, 0, "Enforce MAC/LOMAC policy");
+TUNABLE_INT("security.mac.lomac.enabled", &lomac_enabled);
 
 static int	destroyed_not_inited;
 SYSCTL_INT(_security_mac_lomac, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
@@ -126,46 +126,46 @@ SYSCTL_INT(_security_mac_lomac, OID_AUTO, revocation_enabled, CTLFLAG_RW,
     &revocation_enabled, 0, "Revoke access to objects on relabel");
 TUNABLE_INT("security.mac.lomac.revocation_enabled", &revocation_enabled);
 
-static int	mac_lomac_slot;
-#define	SLOT(l)	((struct mac_lomac *)mac_label_get((l), mac_lomac_slot))
-#define	SLOT_SET(l, val) mac_label_set((l), mac_lomac_slot, (uintptr_t)(val))
+static int	lomac_slot;
+#define	SLOT(l)	((struct mac_lomac *)mac_label_get((l), lomac_slot))
+#define	SLOT_SET(l, val) mac_label_set((l), lomac_slot, (uintptr_t)(val))
 #define	PSLOT(l) ((struct mac_lomac_proc *)				\
-    mac_label_get((l), mac_lomac_slot))
-#define	PSLOT_SET(l, val) mac_label_set((l), mac_lomac_slot, (uintptr_t)(val))
+    mac_label_get((l), lomac_slot))
+#define	PSLOT_SET(l, val) mac_label_set((l), lomac_slot, (uintptr_t)(val))
 
-MALLOC_DEFINE(M_MACLOMAC, "mac_lomac_label", "MAC/LOMAC labels");
+MALLOC_DEFINE(M_LOMAC, "mac_lomac_label", "MAC/LOMAC labels");
 
 static struct mac_lomac *
 lomac_alloc(int flag)
 {
-	struct mac_lomac *mac_lomac;
+	struct mac_lomac *ml;
 
-	mac_lomac = malloc(sizeof(struct mac_lomac), M_MACLOMAC, M_ZERO | flag);
+	ml = malloc(sizeof(*ml), M_LOMAC, M_ZERO | flag);
 
-	return (mac_lomac);
+	return (ml);
 }
 
 static void
-lomac_free(struct mac_lomac *mac_lomac)
+lomac_free(struct mac_lomac *ml)
 {
 
-	if (mac_lomac != NULL)
-		free(mac_lomac, M_MACLOMAC);
+	if (ml != NULL)
+		free(ml, M_LOMAC);
 	else
 		atomic_add_int(&destroyed_not_inited, 1);
 }
 
 static int
-lomac_atmostflags(struct mac_lomac *mac_lomac, int flags)
+lomac_atmostflags(struct mac_lomac *ml, int flags)
 {
 
-	if ((mac_lomac->ml_flags & flags) != mac_lomac->ml_flags)
+	if ((ml->ml_flags & flags) != ml->ml_flags)
 		return (EINVAL);
 	return (0);
 }
 
 static int
-mac_lomac_dominate_element(struct mac_lomac_element *a,
+lomac_dominate_element(struct mac_lomac_element *a,
     struct mac_lomac_element *b)
 {
 
@@ -185,7 +185,7 @@ mac_lomac_dominate_element(struct mac_lomac_element *a,
 			return (1);
 
 		default:
-			panic("mac_lomac_dominate_element: b->mle_type invalid");
+			panic("lomac_dominate_element: b->mle_type invalid");
 		}
 
 	case MAC_LOMAC_TYPE_GRADE:
@@ -201,80 +201,78 @@ mac_lomac_dominate_element(struct mac_lomac_element *a,
 			return (a->mle_grade >= b->mle_grade);
 
 		default:
-			panic("mac_lomac_dominate_element: b->mle_type invalid");
+			panic("lomac_dominate_element: b->mle_type invalid");
 		}
 
 	default:
-		panic("mac_lomac_dominate_element: a->mle_type invalid");
+		panic("lomac_dominate_element: a->mle_type invalid");
 	}
 }
 
 static int
-mac_lomac_range_in_range(struct mac_lomac *rangea, struct mac_lomac *rangeb)
+lomac_range_in_range(struct mac_lomac *rangea, struct mac_lomac *rangeb)
 {
 
-	return (mac_lomac_dominate_element(&rangeb->ml_rangehigh,
+	return (lomac_dominate_element(&rangeb->ml_rangehigh,
 	    &rangea->ml_rangehigh) &&
-	    mac_lomac_dominate_element(&rangea->ml_rangelow,
+	    lomac_dominate_element(&rangea->ml_rangelow,
 	    &rangeb->ml_rangelow));
 }
 
 static int
-mac_lomac_single_in_range(struct mac_lomac *single, struct mac_lomac *range)
+lomac_single_in_range(struct mac_lomac *single, struct mac_lomac *range)
 {
 
 	KASSERT((single->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_single_in_range: a not single"));
+	    ("lomac_single_in_range: a not single"));
 	KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
-	    ("mac_lomac_single_in_range: b not range"));
+	    ("lomac_single_in_range: b not range"));
 
-	return (mac_lomac_dominate_element(&range->ml_rangehigh,
-	    &single->ml_single) &&
-	    mac_lomac_dominate_element(&single->ml_single,
+	return (lomac_dominate_element(&range->ml_rangehigh,
+	    &single->ml_single) && lomac_dominate_element(&single->ml_single,
 	    &range->ml_rangelow));
 }
 
 static int
-mac_lomac_auxsingle_in_range(struct mac_lomac *single, struct mac_lomac *range)
+lomac_auxsingle_in_range(struct mac_lomac *single, struct mac_lomac *range)
 {
 
 	KASSERT((single->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
-	    ("mac_lomac_single_in_range: a not auxsingle"));
+	    ("lomac_single_in_range: a not auxsingle"));
 	KASSERT((range->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
-	    ("mac_lomac_single_in_range: b not range"));
+	    ("lomac_single_in_range: b not range"));
 
-	return (mac_lomac_dominate_element(&range->ml_rangehigh,
+	return (lomac_dominate_element(&range->ml_rangehigh,
 	    &single->ml_auxsingle) &&
-	    mac_lomac_dominate_element(&single->ml_auxsingle,
+	    lomac_dominate_element(&single->ml_auxsingle,
 	    &range->ml_rangelow));
 }
 
 static int
-mac_lomac_dominate_single(struct mac_lomac *a, struct mac_lomac *b)
+lomac_dominate_single(struct mac_lomac *a, struct mac_lomac *b)
 {
 	KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_dominate_single: a not single"));
+	    ("lomac_dominate_single: a not single"));
 	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_dominate_single: b not single"));
+	    ("lomac_dominate_single: b not single"));
 
-	return (mac_lomac_dominate_element(&a->ml_single, &b->ml_single));
+	return (lomac_dominate_element(&a->ml_single, &b->ml_single));
 }
 
 static int
-mac_lomac_subject_dominate(struct mac_lomac *a, struct mac_lomac *b)
+lomac_subject_dominate(struct mac_lomac *a, struct mac_lomac *b)
 {
 	KASSERT((~a->ml_flags &
 	    (MAC_LOMAC_FLAG_SINGLE | MAC_LOMAC_FLAG_RANGE)) == 0,
-	    ("mac_lomac_dominate_single: a not subject"));
+	    ("lomac_dominate_single: a not subject"));
 	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_dominate_single: b not single"));
+	    ("lomac_dominate_single: b not single"));
 
-	return (mac_lomac_dominate_element(&a->ml_rangehigh,
-	    &b->ml_single));
+	return (lomac_dominate_element(&a->ml_rangehigh, &b->ml_single));
 }
 
 static int
-mac_lomac_equal_element(struct mac_lomac_element *a, struct mac_lomac_element *b)
+lomac_equal_element(struct mac_lomac_element *a, struct mac_lomac_element *b)
 {
 
 	if (a->mle_type == MAC_LOMAC_TYPE_EQUAL ||
@@ -285,32 +283,32 @@ mac_lomac_equal_element(struct mac_lomac_element *a, struct mac_lomac_element *b
 }
 
 static int
-mac_lomac_equal_single(struct mac_lomac *a, struct mac_lomac *b)
+lomac_equal_single(struct mac_lomac *a, struct mac_lomac *b)
 {
 
 	KASSERT((a->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_equal_single: a not single"));
+	    ("lomac_equal_single: a not single"));
 	KASSERT((b->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_equal_single: b not single"));
+	    ("lomac_equal_single: b not single"));
 
-	return (mac_lomac_equal_element(&a->ml_single, &b->ml_single));
+	return (lomac_equal_element(&a->ml_single, &b->ml_single));
 }
 
 static int
-mac_lomac_contains_equal(struct mac_lomac *mac_lomac)
+lomac_contains_equal(struct mac_lomac *ml)
 {
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE)
-		if (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
+	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE)
+		if (ml->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
 			return (1);
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX)
-		if (mac_lomac->ml_auxsingle.mle_type == MAC_LOMAC_TYPE_EQUAL)
+	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX)
+		if (ml->ml_auxsingle.mle_type == MAC_LOMAC_TYPE_EQUAL)
 			return (1);
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
-		if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL)
+	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
+		if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL)
 			return (1);
-		if (mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
+		if (ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
 			return (1);
 	}
 
@@ -318,25 +316,25 @@ mac_lomac_contains_equal(struct mac_lomac *mac_lomac)
 }
 
 static int
-mac_lomac_subject_privileged(struct mac_lomac *mac_lomac)
+lomac_subject_privileged(struct mac_lomac *ml)
 {
 
-	KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAGS_BOTH) ==
+	KASSERT((ml->ml_flags & MAC_LOMAC_FLAGS_BOTH) ==
 	    MAC_LOMAC_FLAGS_BOTH,
-	    ("mac_lomac_subject_privileged: subject doesn't have both labels"));
+	    ("lomac_subject_privileged: subject doesn't have both labels"));
 
 	/* If the single is EQUAL, it's ok. */
-	if (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
+	if (ml->ml_single.mle_type == MAC_LOMAC_TYPE_EQUAL)
 		return (0);
 
 	/* If either range endpoint is EQUAL, it's ok. */
-	if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL ||
-	    mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
+	if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_EQUAL ||
+	    ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_EQUAL)
 		return (0);
 
 	/* If the range is low-high, it's ok. */
-	if (mac_lomac->ml_rangelow.mle_type == MAC_LOMAC_TYPE_LOW &&
-	    mac_lomac->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_HIGH)
+	if (ml->ml_rangelow.mle_type == MAC_LOMAC_TYPE_LOW &&
+	    ml->ml_rangehigh.mle_type == MAC_LOMAC_TYPE_HIGH)
 		return (0);
 
 	/* It's not ok. */
@@ -344,21 +342,21 @@ mac_lomac_subject_privileged(struct mac_lomac *mac_lomac)
 }
 
 static int
-mac_lomac_high_single(struct mac_lomac *mac_lomac)
+lomac_high_single(struct mac_lomac *ml)
 {
 
-	KASSERT((mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_high_single: mac_lomac not single"));
+	KASSERT((ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
+	    ("lomac_high_single: mac_lomac not single"));
 
-	return (mac_lomac->ml_single.mle_type == MAC_LOMAC_TYPE_HIGH);
+	return (ml->ml_single.mle_type == MAC_LOMAC_TYPE_HIGH);
 }
 
 static int
-mac_lomac_valid(struct mac_lomac *mac_lomac)
+lomac_valid(struct mac_lomac *ml)
 {
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
-		switch (mac_lomac->ml_single.mle_type) {
+	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
+		switch (ml->ml_single.mle_type) {
 		case MAC_LOMAC_TYPE_GRADE:
 		case MAC_LOMAC_TYPE_EQUAL:
 		case MAC_LOMAC_TYPE_HIGH:
@@ -369,12 +367,12 @@ mac_lomac_valid(struct mac_lomac *mac_lomac)
 			return (EINVAL);
 		}
 	} else {
-		if (mac_lomac->ml_single.mle_type != MAC_LOMAC_TYPE_UNDEF)
+		if (ml->ml_single.mle_type != MAC_LOMAC_TYPE_UNDEF)
 			return (EINVAL);
 	}
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX) {
-		switch (mac_lomac->ml_auxsingle.mle_type) {
+	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX) {
+		switch (ml->ml_auxsingle.mle_type) {
 		case MAC_LOMAC_TYPE_GRADE:
 		case MAC_LOMAC_TYPE_EQUAL:
 		case MAC_LOMAC_TYPE_HIGH:
@@ -385,12 +383,12 @@ mac_lomac_valid(struct mac_lomac *mac_lomac)
 			return (EINVAL);
 		}
 	} else {
-		if (mac_lomac->ml_auxsingle.mle_type != MAC_LOMAC_TYPE_UNDEF)
+		if (ml->ml_auxsingle.mle_type != MAC_LOMAC_TYPE_UNDEF)
 			return (EINVAL);
 	}
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
-		switch (mac_lomac->ml_rangelow.mle_type) {
+	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
+		switch (ml->ml_rangelow.mle_type) {
 		case MAC_LOMAC_TYPE_GRADE:
 		case MAC_LOMAC_TYPE_EQUAL:
 		case MAC_LOMAC_TYPE_HIGH:
@@ -401,7 +399,7 @@ mac_lomac_valid(struct mac_lomac *mac_lomac)
 			return (EINVAL);
 		}
 
-		switch (mac_lomac->ml_rangehigh.mle_type) {
+		switch (ml->ml_rangehigh.mle_type) {
 		case MAC_LOMAC_TYPE_GRADE:
 		case MAC_LOMAC_TYPE_EQUAL:
 		case MAC_LOMAC_TYPE_HIGH:
@@ -411,12 +409,12 @@ mac_lomac_valid(struct mac_lomac *mac_lomac)
 		default:
 			return (EINVAL);
 		}
-		if (!mac_lomac_dominate_element(&mac_lomac->ml_rangehigh,
-		    &mac_lomac->ml_rangelow))
+		if (!lomac_dominate_element(&ml->ml_rangehigh,
+		    &ml->ml_rangelow))
 			return (EINVAL);
 	} else {
-		if (mac_lomac->ml_rangelow.mle_type != MAC_LOMAC_TYPE_UNDEF ||
-		    mac_lomac->ml_rangehigh.mle_type != MAC_LOMAC_TYPE_UNDEF)
+		if (ml->ml_rangelow.mle_type != MAC_LOMAC_TYPE_UNDEF ||
+		    ml->ml_rangehigh.mle_type != MAC_LOMAC_TYPE_UNDEF)
 			return (EINVAL);
 	}
 
@@ -424,32 +422,32 @@ mac_lomac_valid(struct mac_lomac *mac_lomac)
 }
 
 static void
-mac_lomac_set_range(struct mac_lomac *mac_lomac, u_short typelow,
-    u_short gradelow, u_short typehigh, u_short gradehigh)
+lomac_set_range(struct mac_lomac *ml, u_short typelow, u_short gradelow,
+    u_short typehigh, u_short gradehigh)
 {
 
-	mac_lomac->ml_rangelow.mle_type = typelow;
-	mac_lomac->ml_rangelow.mle_grade = gradelow;
-	mac_lomac->ml_rangehigh.mle_type = typehigh;
-	mac_lomac->ml_rangehigh.mle_grade = gradehigh;
-	mac_lomac->ml_flags |= MAC_LOMAC_FLAG_RANGE;
+	ml->ml_rangelow.mle_type = typelow;
+	ml->ml_rangelow.mle_grade = gradelow;
+	ml->ml_rangehigh.mle_type = typehigh;
+	ml->ml_rangehigh.mle_grade = gradehigh;
+	ml->ml_flags |= MAC_LOMAC_FLAG_RANGE;
 }
 
 static void
-mac_lomac_set_single(struct mac_lomac *mac_lomac, u_short type, u_short grade)
+lomac_set_single(struct mac_lomac *ml, u_short type, u_short grade)
 {
 
-	mac_lomac->ml_single.mle_type = type;
-	mac_lomac->ml_single.mle_grade = grade;
-	mac_lomac->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
+	ml->ml_single.mle_type = type;
+	ml->ml_single.mle_grade = grade;
+	ml->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
 }
 
 static void
-mac_lomac_copy_range(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
+lomac_copy_range(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
 {
 
 	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_RANGE) != 0,
-	    ("mac_lomac_copy_range: labelfrom not range"));
+	    ("lomac_copy_range: labelfrom not range"));
 
 	labelto->ml_rangelow = labelfrom->ml_rangelow;
 	labelto->ml_rangehigh = labelfrom->ml_rangehigh;
@@ -457,41 +455,40 @@ mac_lomac_copy_range(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
 }
 
 static void
-mac_lomac_copy_single(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
+lomac_copy_single(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
 {
 
 	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_SINGLE) != 0,
-	    ("mac_lomac_copy_single: labelfrom not single"));
+	    ("lomac_copy_single: labelfrom not single"));
 
 	labelto->ml_single = labelfrom->ml_single;
 	labelto->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
 }
 
 static void
-mac_lomac_copy_auxsingle(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
+lomac_copy_auxsingle(struct mac_lomac *labelfrom, struct mac_lomac *labelto)
 {
 
 	KASSERT((labelfrom->ml_flags & MAC_LOMAC_FLAG_AUX) != 0,
-	    ("mac_lomac_copy_auxsingle: labelfrom not auxsingle"));
+	    ("lomac_copy_auxsingle: labelfrom not auxsingle"));
 
 	labelto->ml_auxsingle = labelfrom->ml_auxsingle;
 	labelto->ml_flags |= MAC_LOMAC_FLAG_AUX;
 }
 
 static void
-mac_lomac_copy(struct mac_lomac *source, struct mac_lomac *dest)
+lomac_copy(struct mac_lomac *source, struct mac_lomac *dest)
 {
 
 	if (source->ml_flags & MAC_LOMAC_FLAG_SINGLE)
-		mac_lomac_copy_single(source, dest);
+		lomac_copy_single(source, dest);
 	if (source->ml_flags & MAC_LOMAC_FLAG_AUX)
-		mac_lomac_copy_auxsingle(source, dest);
+		lomac_copy_auxsingle(source, dest);
 	if (source->ml_flags & MAC_LOMAC_FLAG_RANGE)
-		mac_lomac_copy_range(source, dest);
+		lomac_copy_range(source, dest);
 }
 
-static int	mac_lomac_to_string(struct sbuf *sb,
-		    struct mac_lomac *mac_lomac);
+static int	lomac_to_string(struct sbuf *sb, struct mac_lomac *ml);
 
 static int
 maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
@@ -511,11 +508,11 @@ maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
 	mtx_lock(&subj->mtx);
         if (subj->mac_lomac.ml_flags & MAC_LOMAC_FLAG_UPDATE) {
 		/*
-		 * Check to see if the pending demotion would be more or
-		 * less severe than this one, and keep the more severe.
-		 * This can only happen for a multi-threaded application.
+		 * Check to see if the pending demotion would be more or less
+		 * severe than this one, and keep the more severe.  This can
+		 * only happen for a multi-threaded application.
 		 */
-		if (mac_lomac_dominate_single(objlabel, &subj->mac_lomac)) {
+		if (lomac_dominate_single(objlabel, &subj->mac_lomac)) {
 			mtx_unlock(&subj->mtx);
 			return (0);
 		}
@@ -524,14 +521,14 @@ maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
 	/*
 	 * Always demote the single label.
 	 */
-	mac_lomac_copy_single(objlabel, &subj->mac_lomac);
+	lomac_copy_single(objlabel, &subj->mac_lomac);
 	/*
-	 * Start with the original range, then minimize each side of
-	 * the range to the point of not dominating the object.  The
-	 * high side will always be demoted, of course.
+	 * Start with the original range, then minimize each side of the
+	 * range to the point of not dominating the object.  The high side
+	 * will always be demoted, of course.
 	 */
-	mac_lomac_copy_range(subjlabel, &subj->mac_lomac);
-	if (!mac_lomac_dominate_element(&objlabel->ml_single,
+	lomac_copy_range(subjlabel, &subj->mac_lomac);
+	if (!lomac_dominate_element(&objlabel->ml_single,
 	    &subj->mac_lomac.ml_rangelow))
 		subj->mac_lomac.ml_rangelow = objlabel->ml_single;
 	subj->mac_lomac.ml_rangehigh = objlabel->ml_single;
@@ -541,24 +538,23 @@ maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
 	thread_unlock(curthread);
 
 	/*
-	 * Avoid memory allocation while holding a mutex; cache the
-	 * label.
+	 * Avoid memory allocation while holding a mutex; cache the label.
 	 */
-	mac_lomac_copy_single(&subj->mac_lomac, &cached_subjlabel);
+	lomac_copy_single(&subj->mac_lomac, &cached_subjlabel);
 	mtx_unlock(&subj->mtx);
 
 	sbuf_new(&subjlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
-	mac_lomac_to_string(&subjlabel_sb, subjlabel);
+	lomac_to_string(&subjlabel_sb, subjlabel);
 	sbuf_finish(&subjlabel_sb);
 	subjlabeltext = sbuf_data(&subjlabel_sb);
 
 	sbuf_new(&subjtext_sb, NULL, 0, SBUF_AUTOEXTEND);
-	mac_lomac_to_string(&subjtext_sb, &subj->mac_lomac);
+	lomac_to_string(&subjtext_sb, &subj->mac_lomac);
 	sbuf_finish(&subjtext_sb);
 	subjtext = sbuf_data(&subjtext_sb);
 
 	sbuf_new(&objlabel_sb, NULL, 0, SBUF_AUTOEXTEND);
-	mac_lomac_to_string(&objlabel_sb, objlabel);
+	lomac_to_string(&objlabel_sb, objlabel);
 	sbuf_finish(&objlabel_sb);
 	objlabeltext = sbuf_data(&objlabel_sb);
 
@@ -586,9 +582,9 @@ maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
 }
 
 /*
- * Relabel "to" to "from" only if "from" is a valid label (contains
- * at least a single), as for a relabel operation which may or may
- * not involve a relevant label.
+ * Relabel "to" to "from" only if "from" is a valid label (contains at least
+ * a single), as for a relabel operation which may or may not involve a
+ * relevant label.
  */
 static void
 try_relabel(struct mac_lomac *from, struct mac_lomac *to)
@@ -596,7 +592,7 @@ try_relabel(struct mac_lomac *from, struct mac_lomac *to)
 
 	if (from->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
 		bzero(to, sizeof(*to));
-		mac_lomac_copy(from, to);
+		lomac_copy(from, to);
 	}
 }
 
@@ -604,7 +600,7 @@ try_relabel(struct mac_lomac *from, struct mac_lomac *to)
  * Policy module operations.
  */
 static void
-mac_lomac_init(struct mac_policy_conf *conf)
+lomac_init(struct mac_policy_conf *conf)
 {
 
 }
@@ -613,14 +609,14 @@ mac_lomac_init(struct mac_policy_conf *conf)
  * Label operations.
  */
 static void
-mac_lomac_init_label(struct label *label)
+lomac_init_label(struct label *label)
 {
 
 	SLOT_SET(label, lomac_alloc(M_WAITOK));
 }
 
 static int
-mac_lomac_init_label_waitcheck(struct label *label, int flag)
+lomac_init_label_waitcheck(struct label *label, int flag)
 {
 
 	SLOT_SET(label, lomac_alloc(flag));
@@ -631,16 +627,16 @@ mac_lomac_init_label_waitcheck(struct label *label, int flag)
 }
 
 static void
-mac_lomac_init_proc_label(struct label *label)
+lomac_init_proc_label(struct label *label)
 {
 
-	PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_MACLOMAC,
+	PSLOT_SET(label, malloc(sizeof(struct mac_lomac_proc), M_LOMAC,
 	    M_ZERO | M_WAITOK));
 	mtx_init(&PSLOT(label)->mtx, "MAC/Lomac proc lock", NULL, MTX_DEF);
 }
 
 static void
-mac_lomac_destroy_label(struct label *label)
+lomac_destroy_label(struct label *label)
 {
 
 	lomac_free(SLOT(label));
@@ -648,16 +644,16 @@ mac_lomac_destroy_label(struct label *label)
 }
 
 static void
-mac_lomac_destroy_proc_label(struct label *label)
+lomac_destroy_proc_label(struct label *label)
 {
 
 	mtx_destroy(&PSLOT(label)->mtx);
-	FREE(PSLOT(label), M_MACLOMAC);
+	FREE(PSLOT(label), M_LOMAC);
 	PSLOT_SET(label, NULL);
 }
 
 static int
-mac_lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element)
+lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element)
 {
 
 	switch (element->mle_type) {
@@ -674,46 +670,42 @@ mac_lomac_element_to_string(struct sbuf *sb, struct mac_lomac_element *element)
 		return (sbuf_printf(sb, "%d", element->mle_grade));
 
 	default:
-		panic("mac_lomac_element_to_string: invalid type (%d)",
+		panic("lomac_element_to_string: invalid type (%d)",
 		    element->mle_type);
 	}
 }
 
 static int
-mac_lomac_to_string(struct sbuf *sb, struct mac_lomac *mac_lomac)
+lomac_to_string(struct sbuf *sb, struct mac_lomac *ml)
 {
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
-		if (mac_lomac_element_to_string(sb, &mac_lomac->ml_single)
-		    == -1)
+	if (ml->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
+		if (lomac_element_to_string(sb, &ml->ml_single) == -1)
 			return (EINVAL);
 	}
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_AUX) {
+	if (ml->ml_flags & MAC_LOMAC_FLAG_AUX) {
 		if (sbuf_putc(sb, '[') == -1)
 			return (EINVAL);
 
-		if (mac_lomac_element_to_string(sb, &mac_lomac->ml_auxsingle)
-		    == -1)
+		if (lomac_element_to_string(sb, &ml->ml_auxsingle) == -1)
 			return (EINVAL);
 
 		if (sbuf_putc(sb, ']') == -1)
 			return (EINVAL);
 	}
 
-	if (mac_lomac->ml_flags & MAC_LOMAC_FLAG_RANGE) {
+	if (ml->ml_flags & MAC_LOMAC_FLAG_RANGE) {
 		if (sbuf_putc(sb, '(') == -1)
 			return (EINVAL);
 
-		if (mac_lomac_element_to_string(sb, &mac_lomac->ml_rangelow)
-		    == -1)
+		if (lomac_element_to_string(sb, &ml->ml_rangelow) == -1)
 			return (EINVAL);
 
 		if (sbuf_putc(sb, '-') == -1)
 			return (EINVAL);
 
-		if (mac_lomac_element_to_string(sb, &mac_lomac->ml_rangehigh)
-		    == -1)
+		if (lomac_element_to_string(sb, &ml->ml_rangehigh) == -1)
 			return (EINVAL);
 
 		if (sbuf_putc(sb, ')') == -1)
@@ -724,31 +716,29 @@ mac_lomac_to_string(struct sbuf *sb, struct mac_lomac *mac_lomac)
 }
 
 static int
-mac_lomac_externalize_label(struct label *label, char *element_name,
+lomac_externalize_label(struct label *label, char *element_name,
     struct sbuf *sb, int *claimed)
 {
-	struct mac_lomac *mac_lomac;
+	struct mac_lomac *ml;
 
 	if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
 		return (0);
 
 	(*claimed)++;
 
-	mac_lomac = SLOT(label);
+	ml = SLOT(label);
 
-	return (mac_lomac_to_string(sb, mac_lomac));
+	return (lomac_to_string(sb, ml));
 }
 
 static int
-mac_lomac_parse_element(struct mac_lomac_element *element, char *string)
+lomac_parse_element(struct mac_lomac_element *element, char *string)
 {
 
-	if (strcmp(string, "high") == 0 ||
-	    strcmp(string, "hi") == 0) {
+	if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
 		element->mle_type = MAC_LOMAC_TYPE_HIGH;
 		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
-	} else if (strcmp(string, "low") == 0 ||
-	    strcmp(string, "lo") == 0) {
+	} else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
 		element->mle_type = MAC_LOMAC_TYPE_LOW;
 		element->mle_grade = MAC_LOMAC_TYPE_UNDEF;
 	} else if (strcmp(string, "equal") == 0 ||
@@ -775,11 +765,11 @@ mac_lomac_parse_element(struct mac_lomac_element *element, char *string)
 }
 
 /*
- * Note: destructively consumes the string, make a local copy before
- * calling if that's a problem.
+ * Note: destructively consumes the string, make a local copy before calling
+ * if that's a problem.
  */
 static int
-mac_lomac_parse(struct mac_lomac *mac_lomac, char *string)
+lomac_parse(struct mac_lomac *ml, char *string)
 {
 	char *range, *rangeend, *rangehigh, *rangelow, *single, *auxsingle,
 	    *auxsingleend;
@@ -818,7 +808,7 @@ mac_lomac_parse(struct mac_lomac *mac_lomac, char *string)
 	}
 	KASSERT((rangelow != NULL && rangehigh != NULL) ||
 	    (rangelow == NULL && rangehigh == NULL),
-	    ("mac_lomac_internalize_label: range mismatch"));
+	    ("lomac_internalize_label: range mismatch"));
 	if (auxsingle != NULL) {
 		/* Nul terminate the end of the single string. */
 		*auxsingle = '\0';
@@ -832,35 +822,32 @@ mac_lomac_parse(struct mac_lomac *mac_lomac, char *string)
 		*auxsingleend = '\0';
 	}
 
-	bzero(mac_lomac, sizeof(*mac_lomac));
+	bzero(ml, sizeof(*ml));
 	if (single != NULL) {
-		error = mac_lomac_parse_element(&mac_lomac->ml_single, single);
+		error = lomac_parse_element(&ml->ml_single, single);
 		if (error)
 			return (error);
-		mac_lomac->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
+		ml->ml_flags |= MAC_LOMAC_FLAG_SINGLE;
 	}
 
 	if (auxsingle != NULL) {
-		error = mac_lomac_parse_element(&mac_lomac->ml_auxsingle,
-		    auxsingle);
+		error = lomac_parse_element(&ml->ml_auxsingle, auxsingle);
 		if (error)
 			return (error);
-		mac_lomac->ml_flags |= MAC_LOMAC_FLAG_AUX;
+		ml->ml_flags |= MAC_LOMAC_FLAG_AUX;
 	}
 
 	if (rangelow != NULL) {
-		error = mac_lomac_parse_element(&mac_lomac->ml_rangelow,
-		    rangelow);
+		error = lomac_parse_element(&ml->ml_rangelow, rangelow);
 		if (error)
 			return (error);
-		error = mac_lomac_parse_element(&mac_lomac->ml_rangehigh,
-		    rangehigh);
+		error = lomac_parse_element(&ml->ml_rangehigh, rangehigh);
 		if (error)
 			return (error);
-		mac_lomac->ml_flags |= MAC_LOMAC_FLAG_RANGE;
+		ml->ml_flags |= MAC_LOMAC_FLAG_RANGE;
 	}
 
-	error = mac_lomac_valid(mac_lomac);
+	error = lomac_valid(ml);
 	if (error)
 		return (error);
 
@@ -868,10 +855,10 @@ mac_lomac_parse(struct mac_lomac *mac_lomac, char *string)
 }
 
 static int
-mac_lomac_internalize_label(struct label *label, char *element_name,
+lomac_internalize_label(struct label *label, char *element_name,
     char *element_data, int *claimed)
 {
-	struct mac_lomac *mac_lomac, mac_lomac_temp;
+	struct mac_lomac *ml, ml_temp;
 	int error;
 
 	if (strcmp(MAC_LOMAC_LABEL_NAME, element_name) != 0)
@@ -879,35 +866,35 @@ mac_lomac_internalize_label(struct label *label, char *element_name,
 
 	(*claimed)++;
 
-	error = mac_lomac_parse(&mac_lomac_temp, element_data);
+	error = lomac_parse(&ml_temp, element_data);
 	if (error)
 		return (error);
 
-	mac_lomac = SLOT(label);
-	*mac_lomac = mac_lomac_temp;
+	ml = SLOT(label);
+	*ml = ml_temp;
 
 	return (0);
 }
 
 static void
-mac_lomac_copy_label(struct label *src, struct label *dest)
+lomac_copy_label(struct label *src, struct label *dest)
 {
 
 	*SLOT(dest) = *SLOT(src);
 }
 
 /*
- * Labeling event operations: file system objects, and things that look
- * a lot like file system objects.
+ * Labeling event operations: file system objects, and things that look a lot
+ * like file system objects.
  */
 static void
-mac_lomac_create_devfs_device(struct ucred *cred, struct mount *mp,
+lomac_create_devfs_device(struct ucred *cred, struct mount *mp,
     struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
 {
-	struct mac_lomac *mac_lomac;
+	struct mac_lomac *ml;
 	int lomac_type;
 
-	mac_lomac = SLOT(delabel);
+	ml = SLOT(delabel);
 	if (strcmp(dev->si_name, "null") == 0 ||
 	    strcmp(dev->si_name, "zero") == 0 ||
 	    strcmp(dev->si_name, "random") == 0 ||
@@ -920,21 +907,21 @@ mac_lomac_create_devfs_device(struct ucred *cred, struct mount *mp,
 		lomac_type = MAC_LOMAC_TYPE_EQUAL;
 	else
 		lomac_type = MAC_LOMAC_TYPE_HIGH;
-	mac_lomac_set_single(mac_lomac, lomac_type, 0);
+	lomac_set_single(ml, lomac_type, 0);
 }
 
 static void
-mac_lomac_create_devfs_directory(struct mount *mp, char *dirname,
+lomac_create_devfs_directory(struct mount *mp, char *dirname,
     int dirnamelen, struct devfs_dirent *de, struct label *delabel)
 {
-	struct mac_lomac *mac_lomac;
+	struct mac_lomac *ml;
 
-	mac_lomac = SLOT(delabel);
-	mac_lomac_set_single(mac_lomac, MAC_LOMAC_TYPE_HIGH, 0);
+	ml = SLOT(delabel);
+	lomac_set_single(ml, MAC_LOMAC_TYPE_HIGH, 0);
 }
 
 static void
-mac_lomac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+lomac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
     struct label *delabel)
 {
@@ -943,22 +930,22 @@ mac_lomac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(delabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_mount(struct ucred *cred, struct mount *mp,
+lomac_create_mount(struct ucred *cred, struct mount *mp,
     struct label *mplabel)
 {
 	struct mac_lomac *source, *dest;
 
 	source = SLOT(cred->cr_label);
 	dest = SLOT(mplabel);
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_relabel_vnode(struct ucred *cred, struct vnode *vp,
+lomac_relabel_vnode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *newlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -970,7 +957,7 @@ mac_lomac_relabel_vnode(struct ucred *cred, struct vnode *vp,
 }
 
 static void
-mac_lomac_update_devfs(struct mount *mp, struct devfs_dirent *de,
+lomac_update_devfs(struct mount *mp, struct devfs_dirent *de,
     struct label *delabel, struct vnode *vp, struct label *vplabel)
 {
 	struct mac_lomac *source, *dest;
@@ -978,11 +965,11 @@ mac_lomac_update_devfs(struct mount *mp, struct devfs_dirent *de,
 	source = SLOT(vplabel);
 	dest = SLOT(delabel);
 
-	mac_lomac_copy(source, dest);
+	lomac_copy(source, dest);
 }
 
 static void
-mac_lomac_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
+lomac_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
     struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
     struct label *vplabel)
 {
@@ -991,11 +978,11 @@ mac_lomac_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
 	source = SLOT(delabel);
 	dest = SLOT(vplabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static int
-mac_lomac_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
+lomac_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_lomac temp, *source, *dest;
@@ -1011,14 +998,14 @@ mac_lomac_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
 	    MAC_LOMAC_EXTATTR_NAME, &buflen, (char *)&temp, curthread);
 	if (error == ENOATTR || error == EOPNOTSUPP) {
 		/* Fall back to the mntlabel. */
-		mac_lomac_copy_single(source, dest);
+		lomac_copy_single(source, dest);
 		return (0);
 	} else if (error)
 		return (error);
 
 	if (buflen != sizeof(temp)) {
 		if (buflen != sizeof(temp) - sizeof(temp.ml_auxsingle)) {
-			printf("mac_lomac_associate_vnode_extattr: bad size %d\n",
+			printf("lomac_associate_vnode_extattr: bad size %d\n",
 			    buflen);
 			return (EPERM);
 		}
@@ -1028,21 +1015,21 @@ mac_lomac_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
 		    MAC_LOMAC_EXTATTR_NAMESPACE, MAC_LOMAC_EXTATTR_NAME,
 		    buflen, (char *)&temp, curthread);
 	}
-	if (mac_lomac_valid(&temp) != 0) {
-		printf("mac_lomac_associate_vnode_extattr: invalid\n");
+	if (lomac_valid(&temp) != 0) {
+		printf("lomac_associate_vnode_extattr: invalid\n");
 		return (EPERM);
 	}
 	if ((temp.ml_flags & MAC_LOMAC_FLAGS_BOTH) != MAC_LOMAC_FLAG_SINGLE) {
-		printf("mac_lomac_associate_vnode_extattr: not single\n");
+		printf("lomac_associate_vnode_extattr: not single\n");
 		return (EPERM);
 	}
 
-	mac_lomac_copy_single(&temp, dest);
+	lomac_copy_single(&temp, dest);
 	return (0);
 }
 
 static void
-mac_lomac_associate_vnode_singlelabel(struct mount *mp,
+lomac_associate_vnode_singlelabel(struct mount *mp,
     struct label *mplabel, struct vnode *vp, struct label *vplabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1050,11 +1037,11 @@ mac_lomac_associate_vnode_singlelabel(struct mount *mp,
 	source = SLOT(mplabel);
 	dest = SLOT(vplabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static int
-mac_lomac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
+lomac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
     struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
     struct vnode *vp, struct label *vplabel, struct componentname *cnp)
 {
@@ -1069,22 +1056,22 @@ mac_lomac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 	dest = SLOT(vplabel);
 	dir = SLOT(dvplabel);
 	if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) {
-		mac_lomac_copy_auxsingle(dir, &temp);
-		mac_lomac_set_single(&temp, dir->ml_auxsingle.mle_type,
+		lomac_copy_auxsingle(dir, &temp);
+		lomac_set_single(&temp, dir->ml_auxsingle.mle_type,
 		    dir->ml_auxsingle.mle_grade);
 	} else {
-		mac_lomac_copy_single(source, &temp);
+		lomac_copy_single(source, &temp);
 	}
 
 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
 	    MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
 	if (error == 0)
-		mac_lomac_copy(&temp, dest);
+		lomac_copy(&temp, dest);
 	return (error);
 }
 
 static int
-mac_lomac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
+lomac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *intlabel)
 {
 	struct mac_lomac *source, temp;
@@ -1098,7 +1085,7 @@ mac_lomac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
 	if ((source->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
 		return (0);
 
-	mac_lomac_copy_single(source, &temp);
+	lomac_copy_single(source, &temp);
 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_LOMAC_EXTATTR_NAMESPACE,
 	    MAC_LOMAC_EXTATTR_NAME, buflen, (char *)&temp, curthread);
 	return (error);
@@ -1108,7 +1095,7 @@ mac_lomac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
  * Labeling event operations: IPC object.
  */
 static void
-mac_lomac_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+lomac_create_inpcb_from_socket(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1116,11 +1103,11 @@ mac_lomac_create_inpcb_from_socket(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(inplabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_from_socket(struct socket *so, struct label *solabel,
+lomac_create_mbuf_from_socket(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1128,11 +1115,11 @@ mac_lomac_create_mbuf_from_socket(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(mlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_socket(struct ucred *cred, struct socket *so,
+lomac_create_socket(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1140,11 +1127,11 @@ mac_lomac_create_socket(struct ucred *cred, struct socket *so,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(solabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_pipe(struct ucred *cred, struct pipepair *pp,
+lomac_create_pipe(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1152,11 +1139,11 @@ mac_lomac_create_pipe(struct ucred *cred, struct pipepair *pp,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(pplabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_socket_from_socket(struct socket *oldso,
+lomac_create_socket_from_socket(struct socket *oldso,
     struct label *oldsolabel, struct socket *newso, struct label *newsolabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1164,11 +1151,11 @@ mac_lomac_create_socket_from_socket(struct socket *oldso,
 	source = SLOT(oldsolabel);
 	dest = SLOT(newsolabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_relabel_socket(struct ucred *cred, struct socket *so,
+lomac_relabel_socket(struct ucred *cred, struct socket *so,
     struct label *solabel, struct label *newlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1180,7 +1167,7 @@ mac_lomac_relabel_socket(struct ucred *cred, struct socket *so,
 }
 
 static void
-mac_lomac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
+lomac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, struct label *newlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1192,7 +1179,7 @@ mac_lomac_relabel_pipe(struct ucred *cred, struct pipepair *pp,
 }
 
 static void
-mac_lomac_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
+lomac_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
     struct socket *so, struct label *sopeerlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1200,14 +1187,14 @@ mac_lomac_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(sopeerlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 /*
  * Labeling event operations: network objects.
  */
 static void
-mac_lomac_set_socket_peer_from_socket(struct socket *oldso,
+lomac_set_socket_peer_from_socket(struct socket *oldso,
     struct label *oldsolabel, struct socket *newso,
     struct label *newsopeerlabel)
 {
@@ -1216,11 +1203,11 @@ mac_lomac_set_socket_peer_from_socket(struct socket *oldso,
 	source = SLOT(oldsolabel);
 	dest = SLOT(newsopeerlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
+lomac_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
     struct label *dlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1228,11 +1215,11 @@ mac_lomac_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(dlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
+lomac_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
 {
 	char tifname[IFNAMSIZ], *p, *q;
 	char tiflist[sizeof(trusted_interfaces)];
@@ -1285,12 +1272,12 @@ mac_lomac_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
 		}
 	}
 set:
-	mac_lomac_set_single(dest, grade, 0);
-	mac_lomac_set_range(dest, grade, 0, grade, 0);
+	lomac_set_single(dest, grade, 0);
+	lomac_set_range(dest, grade, 0, grade, 0);
 }
 
 static void
-mac_lomac_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
+lomac_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
     struct label *ipqlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1298,11 +1285,11 @@ mac_lomac_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
 	source = SLOT(mlabel);
 	dest = SLOT(ipqlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
+lomac_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1311,11 +1298,11 @@ mac_lomac_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
 	dest = SLOT(mlabel);
 
 	/* Just use the head, since we require them all to match. */
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_fragment(struct mbuf *m, struct label *mlabel,
+lomac_create_fragment(struct mbuf *m, struct label *mlabel,
     struct mbuf *frag, struct label *fraglabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1323,11 +1310,11 @@ mac_lomac_create_fragment(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(fraglabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
+lomac_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1335,22 +1322,22 @@ mac_lomac_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
 	source = SLOT(inplabel);
 	dest = SLOT(mlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
+lomac_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *dest;
 
 	dest = SLOT(mlabel);
 
-	mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
+	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
 }
 
 static void
-mac_lomac_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
+lomac_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1358,11 +1345,11 @@ mac_lomac_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
 	source = SLOT(dlabel);
 	dest = SLOT(mlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
+lomac_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1370,11 +1357,11 @@ mac_lomac_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
 	source = SLOT(ifplabel);
 	dest = SLOT(mlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
+lomac_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
     struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew,
     struct label *mnewlabel)
 {
@@ -1383,11 +1370,11 @@ mac_lomac_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(mnewlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
+lomac_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
     struct mbuf *mnew, struct label *mnewlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1395,11 +1382,11 @@ mac_lomac_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(mnewlabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static int
-mac_lomac_fragment_match(struct mbuf *m, struct label *mlabel,
+lomac_fragment_match(struct mbuf *m, struct label *mlabel,
     struct ipq *ipq, struct label *ipqlabel)
 {
 	struct mac_lomac *a, *b;
@@ -1407,11 +1394,11 @@ mac_lomac_fragment_match(struct mbuf *m, struct label *mlabel,
 	a = SLOT(ipqlabel);
 	b = SLOT(mlabel);
 
-	return (mac_lomac_equal_single(a, b));
+	return (lomac_equal_single(a, b));
 }
 
 static void
-mac_lomac_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
+lomac_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
     struct label *ifplabel, struct label *newlabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1423,7 +1410,7 @@ mac_lomac_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
 }
 
 static void
-mac_lomac_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
+lomac_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
     struct label *ipqlabel)
 {
 
@@ -1431,7 +1418,7 @@ mac_lomac_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
 }
 
 static void
-mac_lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 	struct mac_lomac *source, *dest;
@@ -1439,46 +1426,46 @@ mac_lomac_inpcb_sosetlabel(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(inplabel);
 
-	mac_lomac_copy_single(source, dest);
+	lomac_copy_single(source, dest);
 }
 
 static void
-mac_lomac_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
+lomac_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
 {
 	struct mac_lomac *source, *dest;
 
 	source = SLOT(inp->inp_label);
 	dest = SLOT(label);
-	mac_lomac_copy(source, dest);
+	lomac_copy(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
+lomac_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
     struct label *mlabel)
 {
 	struct mac_lomac *source, *dest;
 
 	source = SLOT(sc_label);
 	dest = SLOT(mlabel);
-	mac_lomac_copy(source, dest);
+	lomac_copy(source, dest);
 }
 
 static void
-mac_lomac_create_mbuf_from_firewall(struct mbuf *m, struct label *mlabel)
+lomac_create_mbuf_from_firewall(struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *dest;
 
 	dest = SLOT(mlabel);
 
 	/* XXX: where is the label for the firewall really comming from? */
-	mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
+	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
 }
 
 /*
  * Labeling event operations: processes.
  */
 static void
-mac_lomac_execve_transition(struct ucred *old, struct ucred *new,
+lomac_execve_transition(struct ucred *old, struct ucred *new,
     struct vnode *vp, struct label *vplabel, struct label *interpvnodelabel,
     struct image_params *imgp, struct label *execlabel)
 {
@@ -1489,38 +1476,37 @@ mac_lomac_execve_transition(struct ucred *old, struct ucred *new,
 	obj = SLOT(vplabel);
 	robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
 
-	mac_lomac_copy(source, dest);
+	lomac_copy(source, dest);
 	/*
-	 * If there's an auxiliary label on the real object, respect it
-	 * and assume that this level should be assumed immediately if
-	 * a higher level is currently in place.
+	 * If there's an auxiliary label on the real object, respect it and
+	 * assume that this level should be assumed immediately if a higher
+	 * level is currently in place.
 	 */
 	if (robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
-	    !mac_lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single)
-	    && mac_lomac_auxsingle_in_range(robj, dest))
-		mac_lomac_set_single(dest, robj->ml_auxsingle.mle_type,
+	    !lomac_dominate_element(&robj->ml_auxsingle, &dest->ml_single)
+	    && lomac_auxsingle_in_range(robj, dest))
+		lomac_set_single(dest, robj->ml_auxsingle.mle_type,
 		    robj->ml_auxsingle.mle_grade);
 	/*
-	 * Restructuring to use the execve transitioning mechanism
-	 * instead of the normal demotion mechanism here would be
-	 * difficult, so just copy the label over and perform standard
-	 * demotion.  This is also non-optimal because it will result
-	 * in the intermediate label "new" being created and immediately
-	 * recycled.
+	 * Restructuring to use the execve transitioning mechanism instead of
+	 * the normal demotion mechanism here would be difficult, so just
+	 * copy the label over and perform standard demotion.  This is also
+	 * non-optimal because it will result in the intermediate label "new"
+	 * being created and immediately recycled.
 	 */
-	if (mac_lomac_enabled && revocation_enabled &&
-	    !mac_lomac_dominate_single(obj, source))
+	if (lomac_enabled && revocation_enabled &&
+	    !lomac_dominate_single(obj, source))
 		(void)maybe_demote(source, obj, "executing", "file", vp);
 }
 
 static int
-mac_lomac_execve_will_transition(struct ucred *old, struct vnode *vp,
+lomac_execve_will_transition(struct ucred *old, struct vnode *vp,
     struct label *vplabel, struct label *interpvnodelabel,
     struct image_params *imgp, struct label *execlabel)
 {
 	struct mac_lomac *subj, *obj, *robj;
 
-	if (!mac_lomac_enabled || !revocation_enabled)
+	if (!lomac_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(old->cr_label);
@@ -1528,37 +1514,35 @@ mac_lomac_execve_will_transition(struct ucred *old, struct vnode *vp,
 	robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
 
 	return ((robj->ml_flags & MAC_LOMAC_FLAG_AUX &&
-	    !mac_lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single)
-	    && mac_lomac_auxsingle_in_range(robj, subj)) ||
-	    !mac_lomac_dominate_single(obj, subj));
+	    !lomac_dominate_element(&robj->ml_auxsingle, &subj->ml_single)
+	    && lomac_auxsingle_in_range(robj, subj)) ||
+	    !lomac_dominate_single(obj, subj));
 }
 
 static void
-mac_lomac_create_proc0(struct ucred *cred)
+lomac_create_proc0(struct ucred *cred)
 {
 	struct mac_lomac *dest;
 
 	dest = SLOT(cred->cr_label);
 
-	mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
-	mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
-	    0);
+	lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
+	lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0);
 }
 
 static void
-mac_lomac_create_proc1(struct ucred *cred)
+lomac_create_proc1(struct ucred *cred)
 {
 	struct mac_lomac *dest;
 
 	dest = SLOT(cred->cr_label);
 
-	mac_lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0);
-	mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
-	    0);
+	lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0);
+	lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH, 0);
 }
 
 static void
-mac_lomac_relabel_cred(struct ucred *cred, struct label *newlabel)
+lomac_relabel_cred(struct ucred *cred, struct label *newlabel)
 {
 	struct mac_lomac *source, *dest;
 
@@ -1572,24 +1556,24 @@ mac_lomac_relabel_cred(struct ucred *cred, struct label *newlabel)
  * Access control checks.
  */
 static int
-mac_lomac_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
+lomac_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
     struct ifnet *ifp, struct label *ifplabel)
 {
 	struct mac_lomac *a, *b;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	a = SLOT(dlabel);
 	b = SLOT(ifplabel);
 
-	if (mac_lomac_equal_single(a, b))
+	if (lomac_equal_single(a, b))
 		return (0);
 	return (EACCES);
 }
 
 static int
-mac_lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 {
 	struct mac_lomac *subj, *new;
 	int error;
@@ -1598,8 +1582,8 @@ mac_lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 	new = SLOT(newlabel);
 
 	/*
-	 * If there is a LOMAC label update for the credential, it may
-	 * be an update of the single, range, or both.
+	 * If there is a LOMAC label update for the credential, it may be an
+	 * update of the single, range, or both.
 	 */
 	error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
 	if (error)
@@ -1613,33 +1597,31 @@ mac_lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 		 * Fill in the missing parts from the previous label.
 		 */
 		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
-			mac_lomac_copy_single(subj, new);
+			lomac_copy_single(subj, new);
 		if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
-			mac_lomac_copy_range(subj, new);
+			lomac_copy_range(subj, new);
 
 		/*
-		 * To change the LOMAC range on a credential, the new
-		 * range label must be in the current range.
+		 * To change the LOMAC range on a credential, the new range
+		 * label must be in the current range.
 		 */
-		if (!mac_lomac_range_in_range(new, subj))
+		if (!lomac_range_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To change the LOMAC single label on a credential, the
-		 * new single label must be in the new range.  Implicitly
-		 * from the previous check, the new single is in the old
-		 * range.
+		 * To change the LOMAC single label on a credential, the new
+		 * single label must be in the new range.  Implicitly from
+		 * the previous check, the new single is in the old range.
 		 */
-		if (!mac_lomac_single_in_range(new, new))
+		if (!lomac_single_in_range(new, new))
 			return (EPERM);
 
 		/*
-		 * To have EQUAL in any component of the new credential
-		 * LOMAC label, the subject must already have EQUAL in
-		 * their label.
+		 * To have EQUAL in any component of the new credential LOMAC
+		 * label, the subject must already have EQUAL in their label.
 		 */
-		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_privileged(subj);
+		if (lomac_contains_equal(new)) {
+			error = lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1655,25 +1637,25 @@ mac_lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 }
 
 static int
-mac_lomac_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
+lomac_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cr1->cr_label);
 	obj = SLOT(cr2->cr_label);
 
 	/* XXX: range */
-	if (!mac_lomac_dominate_single(obj, subj))
+	if (!lomac_dominate_single(obj, subj))
 		return (ESRCH);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
+lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
     struct label *ifplabel, struct label *newlabel)
 {
 	struct mac_lomac *subj, *new;
@@ -1683,8 +1665,8 @@ mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 	new = SLOT(newlabel);
 
 	/*
-	 * If there is a LOMAC label update for the interface, it may
-	 * be an update of the single, range, or both.
+	 * If there is a LOMAC label update for the interface, it may be an
+	 * update of the single, range, or both.
 	 */
 	error = lomac_atmostflags(new, MAC_LOMAC_FLAGS_BOTH);
 	if (error)
@@ -1693,7 +1675,7 @@ mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 	/*
 	 * Relabling network interfaces requires LOMAC privilege.
 	 */
-	error = mac_lomac_subject_privileged(subj);
+	error = lomac_subject_privileged(subj);
 	if (error)
 		return (error);
 
@@ -1705,9 +1687,9 @@ mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 		 * Fill in the missing parts from the previous label.
 		 */
 		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
-			mac_lomac_copy_single(subj, new);
+			lomac_copy_single(subj, new);
 		if ((new->ml_flags & MAC_LOMAC_FLAG_RANGE) == 0)
-			mac_lomac_copy_range(subj, new);
+			lomac_copy_range(subj, new);
 
 		/*
 		 * Rely on the traditional superuser status for the LOMAC
@@ -1730,62 +1712,62 @@ mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 }
 
 static int
-mac_lomac_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
+lomac_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *p, *i;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	i = SLOT(ifplabel);
 
-	return (mac_lomac_single_in_range(p, i) ? 0 : EACCES);
+	return (lomac_single_in_range(p, i) ? 0 : EACCES);
 }
 
 static int
-mac_lomac_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+lomac_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *p, *i;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	i = SLOT(inplabel);
 
-	return (mac_lomac_equal_single(p, i) ? 0 : EACCES);
+	return (lomac_equal_single(p, i) ? 0 : EACCES);
 }
 
 static int
-mac_lomac_check_kld_load(struct ucred *cred, struct vnode *vp,
+lomac_check_kld_load(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (mac_lomac_subject_privileged(subj))
+	if (lomac_subject_privileged(subj))
 		return (EPERM);
 
-	if (!mac_lomac_high_single(obj))
+	if (!lomac_high_single(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
+lomac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
 {
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	/* XXX: This will be implemented soon... */
@@ -1794,25 +1776,25 @@ mac_lomac_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
 }
 
 static int
-mac_lomac_check_pipe_read(struct ucred *cred, struct pipepair *pp,
+lomac_check_pipe_read(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_lomac_dominate_single(obj, subj))
+	if (!lomac_dominate_single(obj, subj))
 		return (maybe_demote(subj, obj, "reading", "pipe", NULL));
 
 	return (0);
 }
 
 static int
-mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
+lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, struct label *newlabel)
 {
 	struct mac_lomac *subj, *obj, *new;
@@ -1823,8 +1805,8 @@ mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	obj = SLOT(pplabel);
 
 	/*
-	 * If there is a LOMAC label update for a pipe, it must be a
-	 * single update.
+	 * If there is a LOMAC label update for a pipe, it must be a single
+	 * update.
 	 */
 	error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
 	if (error)
@@ -1834,7 +1816,7 @@ mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	 * To perform a relabel of a pipe (LOMAC label or not), LOMAC must
 	 * authorize the relabel.
 	 */
-	if (!mac_lomac_single_in_range(obj, subj))
+	if (!lomac_single_in_range(obj, subj))
 		return (EPERM);
 
 	/*
@@ -1845,15 +1827,15 @@ mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 		 * To change the LOMAC label on a pipe, the new pipe label
 		 * must be in the subject range.
 		 */
-		if (!mac_lomac_single_in_range(new, subj))
+		if (!lomac_single_in_range(new, subj))
 			return (EPERM);
 
 		/*
 		 * To change the LOMAC label on a pipe to be EQUAL, the
 		 * subject must have appropriate privilege.
 		 */
-		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_privileged(subj);
+		if (lomac_contains_equal(new)) {
+			error = lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1863,100 +1845,100 @@ mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 }
 
 static int
-mac_lomac_check_pipe_write(struct ucred *cred, struct pipepair *pp,
+lomac_check_pipe_write(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_proc_debug(struct ucred *cred, struct proc *p)
+lomac_check_proc_debug(struct ucred *cred, struct proc *p)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_lomac_dominate_single(obj, subj))
+	if (!lomac_dominate_single(obj, subj))
 		return (ESRCH);
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_proc_sched(struct ucred *cred, struct proc *p)
+lomac_check_proc_sched(struct ucred *cred, struct proc *p)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_lomac_dominate_single(obj, subj))
+	if (!lomac_dominate_single(obj, subj))
 		return (ESRCH);
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
+lomac_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_lomac_dominate_single(obj, subj))
+	if (!lomac_dominate_single(obj, subj))
 		return (ESRCH);
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_socket_deliver(struct socket *so, struct label *solabel,
+lomac_check_socket_deliver(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_lomac *p, *s;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	s = SLOT(solabel);
 
-	return (mac_lomac_equal_single(p, s) ? 0 : EACCES);
+	return (lomac_equal_single(p, s) ? 0 : EACCES);
 }
 
 static int
-mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *so,
+lomac_check_socket_relabel(struct ucred *cred, struct socket *so,
     struct label *solabel, struct label *newlabel)
 {
 	struct mac_lomac *subj, *obj, *new;
@@ -1967,8 +1949,8 @@ mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *so,
 	obj = SLOT(solabel);
 
 	/*
-	 * If there is a LOMAC label update for the socket, it may be
-	 * an update of single.
+	 * If there is a LOMAC label update for the socket, it may be an
+	 * update of single.
 	 */
 	error = lomac_atmostflags(new, MAC_LOMAC_FLAG_SINGLE);
 	if (error)
@@ -1978,7 +1960,7 @@ mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *so,
 	 * To relabel a socket, the old socket single must be in the subject
 	 * range.
 	 */
-	if (!mac_lomac_single_in_range(obj, subj))
+	if (!lomac_single_in_range(obj, subj))
 		return (EPERM);
 
 	/*
@@ -1986,18 +1968,18 @@ mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *so,
 	 */
 	if (new->ml_flags & MAC_LOMAC_FLAG_SINGLE) {
 		/*
-		 * To relabel a socket, the new socket single must be in
-		 * the subject range.
+		 * To relabel a socket, the new socket single must be in the
+		 * subject range.
 		 */
-		if (!mac_lomac_single_in_range(new, subj))
+		if (!lomac_single_in_range(new, subj))
 			return (EPERM);
 
 		/*
 		 * To change the LOMAC label on the socket to contain EQUAL,
 		 * the subject must have appropriate privilege.
 		 */
-		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_privileged(subj);
+		if (lomac_contains_equal(new)) {
+			error = lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2007,18 +1989,18 @@ mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *so,
 }
 
 static int
-mac_lomac_check_socket_visible(struct ucred *cred, struct socket *so,
+lomac_check_socket_visible(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(solabel);
 
-	if (!mac_lomac_dominate_single(obj, subj))
+	if (!lomac_dominate_single(obj, subj))
 		return (ENOENT);
 
 	return (0);
@@ -2030,12 +2012,12 @@ mac_lomac_check_socket_visible(struct ucred *cred, struct socket *so,
  * policy as they might otherwise allow bypassing of the integrity policy.
  */
 static int
-mac_lomac_priv_check(struct ucred *cred, int priv)
+lomac_priv_check(struct ucred *cred, int priv)
 {
 	struct mac_lomac *subj;
 	int error;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	/*
@@ -2206,7 +2188,7 @@ mac_lomac_priv_check(struct ucred *cred, int priv)
 	 */
 	default:
 		subj = SLOT(cred->cr_label);
-		error = mac_lomac_subject_privileged(subj);
+		error = lomac_subject_privileged(subj);
 		if (error)
 			return (error);
 	}
@@ -2215,107 +2197,107 @@ mac_lomac_priv_check(struct ucred *cred, int priv)
 
 
 static int
-mac_lomac_check_system_acct(struct ucred *cred, struct vnode *vp,
+lomac_check_system_acct(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (mac_lomac_subject_privileged(subj))
+	if (lomac_subject_privileged(subj))
 		return (EPERM);
 
-	if (!mac_lomac_high_single(obj))
+	if (!lomac_high_single(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_system_auditctl(struct ucred *cred, struct vnode *vp,
+lomac_check_system_auditctl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (mac_lomac_subject_privileged(subj))
+	if (lomac_subject_privileged(subj))
 		return (EPERM);
 
-	if (!mac_lomac_high_single(obj))
+	if (!lomac_high_single(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_system_swapoff(struct ucred *cred, struct vnode *vp,
+lomac_check_system_swapoff(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_lomac *subj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
-	if (mac_lomac_subject_privileged(subj))
+	if (lomac_subject_privileged(subj))
 		return (EPERM);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_system_swapon(struct ucred *cred, struct vnode *vp,
+lomac_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (mac_lomac_subject_privileged(subj))
+	if (lomac_subject_privileged(subj))
 		return (EPERM);
 
-	if (!mac_lomac_high_single(obj))
+	if (!lomac_high_single(obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
+lomac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
     void *arg1, int arg2, struct sysctl_req *req)
 {
 	struct mac_lomac *subj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 
 	/*
-	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as
-	 * lomac/high, but also require privilege to change them.
+	 * Treat sysctl variables without CTLFLAG_ANYBODY flag as lomac/high,
+	 * but also require privilege to change them.
 	 */
 	if (req->newptr != NULL && (oidp->oid_kind & CTLFLAG_ANYBODY) == 0) {
 #ifdef notdef
-		if (!mac_lomac_subject_dominate_high(subj))
+		if (!lomac_subject_dominate_high(subj))
 			return (EACCES);
 #endif
 
-		if (mac_lomac_subject_privileged(subj))
+		if (lomac_subject_privileged(subj))
 			return (EPERM);
 	}
 
@@ -2323,70 +2305,70 @@ mac_lomac_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
 }
 
 static int
-mac_lomac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+lomac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 	if (obj->ml_flags & MAC_LOMAC_FLAG_AUX &&
-	    !mac_lomac_dominate_element(&subj->ml_single, &obj->ml_auxsingle))
+	    !lomac_dominate_element(&subj->ml_single, &obj->ml_auxsingle))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
+lomac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int prot, int flags)
 {
 	struct mac_lomac *subj, *obj;
@@ -2395,18 +2377,18 @@ mac_lomac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 	 * Rely on the use of open()-time protections to handle
 	 * non-revocation cases.
 	 */
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
 	if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
-		if (!mac_lomac_subject_dominate(subj, obj))
+		if (!lomac_subject_dominate(subj, obj))
 			return (EACCES);
 	}
 	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
-		if (!mac_lomac_dominate_single(obj, subj))
+		if (!lomac_dominate_single(obj, subj))
 			return (maybe_demote(subj, obj, "mapping", "file", vp));
 	}
 
@@ -2414,7 +2396,7 @@ mac_lomac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 }
 
 static void
-mac_lomac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, /* XXX vm_prot_t */ int *prot)
 {
 	struct mac_lomac *subj, *obj;
@@ -2423,23 +2405,23 @@ mac_lomac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,
 	 * Rely on the use of open()-time protections to handle
 	 * non-revocation cases.
 	 */
-	if (!mac_lomac_enabled || !revocation_enabled)
+	if (!lomac_enabled || !revocation_enabled)
 		return;
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		*prot &= ~VM_PROT_WRITE;
 }
 
 static int
-mac_lomac_check_vnode_open(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_open(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int acc_mode)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -2447,7 +2429,7 @@ mac_lomac_check_vnode_open(struct ucred *cred, struct vnode *vp,
 
 	/* XXX privilege override for admin? */
 	if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
-		if (!mac_lomac_subject_dominate(subj, obj))
+		if (!lomac_subject_dominate(subj, obj))
 			return (EACCES);
 	}
 
@@ -2455,25 +2437,25 @@ mac_lomac_check_vnode_open(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_lomac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+lomac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled || !revocation_enabled)
+	if (!lomac_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_dominate_single(obj, subj))
+	if (!lomac_dominate_single(obj, subj))
 		return (maybe_demote(subj, obj, "reading", "file", vp));
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *newlabel)
 {
 	struct mac_lomac *old, *new, *subj;
@@ -2496,7 +2478,7 @@ mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 	 * To perform a relabel of the vnode (LOMAC label or not), LOMAC must
 	 * authorize the relabel.
 	 */
-	if (!mac_lomac_single_in_range(old, subj))
+	if (!lomac_single_in_range(old, subj))
 		return (EPERM);
 
 	/*
@@ -2507,15 +2489,15 @@ mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 		 * To change the LOMAC label on a vnode, the new vnode label
 		 * must be in the subject range.
 		 */
-		if (!mac_lomac_single_in_range(new, subj))
+		if (!lomac_single_in_range(new, subj))
 			return (EPERM);
 
 		/*
 		 * To change the LOMAC label on the vnode to be EQUAL,
 		 * the subject must have appropriate privilege.
 		 */
-		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_privileged(subj);
+		if (lomac_contains_equal(new)) {
+			error = lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2525,21 +2507,21 @@ mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 		 * Fill in the missing parts from the previous label.
 		 */
 		if ((new->ml_flags & MAC_LOMAC_FLAG_SINGLE) == 0)
-			mac_lomac_copy_single(subj, new);
+			lomac_copy_single(subj, new);
 
 		/*
 		 * To change the auxiliary LOMAC label on a vnode, the new
 		 * vnode label must be in the subject range.
 		 */
-		if (!mac_lomac_auxsingle_in_range(new, subj))
+		if (!lomac_auxsingle_in_range(new, subj))
 			return (EPERM);
 
 		/*
 		 * To change the auxiliary LOMAC label on the vnode to be
 		 * EQUAL, the subject must have appropriate privilege.
 		 */
-		if (mac_lomac_contains_equal(new)) {
-			error = mac_lomac_subject_privileged(subj);
+		if (lomac_contains_equal(new)) {
+			error = lomac_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2549,49 +2531,49 @@ mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_lomac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+lomac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+lomac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     int samedir, struct componentname *cnp)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	if (vp != NULL) {
 		obj = SLOT(vplabel);
 
-		if (!mac_lomac_subject_dominate(subj, obj))
+		if (!lomac_subject_dominate(subj, obj))
 			return (EACCES);
 	}
 
@@ -2599,55 +2581,55 @@ mac_lomac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 }
 
 static int
-mac_lomac_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type, struct acl *acl)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	/* XXX: protect the MAC EA in a special way? */
@@ -2656,121 +2638,121 @@ mac_lomac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_lomac_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, u_long flags)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, mode_t mode)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, uid_t uid, gid_t gid)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+lomac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct timespec atime, struct timespec mtime)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
+lomac_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled)
+	if (!lomac_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_lomac_check_vnode_write(struct ucred *active_cred,
+lomac_check_vnode_write(struct ucred *active_cred,
     struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
 {
 	struct mac_lomac *subj, *obj;
 
-	if (!mac_lomac_enabled || !revocation_enabled)
+	if (!lomac_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_lomac_subject_dominate(subj, obj))
+	if (!lomac_subject_dominate(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static void
-mac_lomac_thread_userret(struct thread *td)
+lomac_thread_userret(struct thread *td)
 {
 	struct proc *p = td->td_proc;
 	struct mac_lomac_proc *subj = PSLOT(p->p_label);
@@ -2800,7 +2782,7 @@ mac_lomac_thread_userret(struct thread *td)
 		oldcred = p->p_ucred;
 		crcopy(newcred, oldcred);
 		crhold(newcred);
-		mac_lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label));
+		lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label));
 		p->p_ucred = newcred;
 		crfree(oldcred);
 		dodrop = 1;
@@ -2815,146 +2797,142 @@ mac_lomac_thread_userret(struct thread *td)
 	}
 }
 
-static struct mac_policy_ops mac_lomac_ops =
-{
-	.mpo_init = mac_lomac_init,
-	.mpo_init_bpfdesc_label = mac_lomac_init_label,
-	.mpo_init_cred_label = mac_lomac_init_label,
-	.mpo_init_devfs_label = mac_lomac_init_label,
-	.mpo_init_ifnet_label = mac_lomac_init_label,
-	.mpo_init_syncache_label = mac_lomac_init_label_waitcheck,
-	.mpo_init_inpcb_label = mac_lomac_init_label_waitcheck,
-	.mpo_init_ipq_label = mac_lomac_init_label_waitcheck,
-	.mpo_init_mbuf_label = mac_lomac_init_label_waitcheck,
-	.mpo_init_mount_label = mac_lomac_init_label,
-	.mpo_init_pipe_label = mac_lomac_init_label,
-	.mpo_init_proc_label = mac_lomac_init_proc_label,
-	.mpo_init_socket_label = mac_lomac_init_label_waitcheck,
-	.mpo_init_socket_peer_label = mac_lomac_init_label_waitcheck,
-	.mpo_init_vnode_label = mac_lomac_init_label,
-	.mpo_init_syncache_from_inpcb = mac_lomac_init_syncache_from_inpcb,
-	.mpo_destroy_bpfdesc_label = mac_lomac_destroy_label,
-	.mpo_destroy_cred_label = mac_lomac_destroy_label,
-	.mpo_destroy_devfs_label = mac_lomac_destroy_label,
-	.mpo_destroy_ifnet_label = mac_lomac_destroy_label,
-	.mpo_destroy_inpcb_label = mac_lomac_destroy_label,
-	.mpo_destroy_ipq_label = mac_lomac_destroy_label,
-	.mpo_destroy_mbuf_label = mac_lomac_destroy_label,
-	.mpo_destroy_mount_label = mac_lomac_destroy_label,
-	.mpo_destroy_pipe_label = mac_lomac_destroy_label,
-	.mpo_destroy_proc_label = mac_lomac_destroy_proc_label,
-	.mpo_destroy_syncache_label = mac_lomac_destroy_label,
-	.mpo_destroy_socket_label = mac_lomac_destroy_label,
-	.mpo_destroy_socket_peer_label = mac_lomac_destroy_label,
-	.mpo_destroy_vnode_label = mac_lomac_destroy_label,
-	.mpo_copy_cred_label = mac_lomac_copy_label,
-	.mpo_copy_ifnet_label = mac_lomac_copy_label,
-	.mpo_copy_mbuf_label = mac_lomac_copy_label,
-	.mpo_copy_pipe_label = mac_lomac_copy_label,
-	.mpo_copy_socket_label = mac_lomac_copy_label,
-	.mpo_copy_vnode_label = mac_lomac_copy_label,
-	.mpo_externalize_cred_label = mac_lomac_externalize_label,
-	.mpo_externalize_ifnet_label = mac_lomac_externalize_label,
-	.mpo_externalize_pipe_label = mac_lomac_externalize_label,
-	.mpo_externalize_socket_label = mac_lomac_externalize_label,
-	.mpo_externalize_socket_peer_label = mac_lomac_externalize_label,
-	.mpo_externalize_vnode_label = mac_lomac_externalize_label,
-	.mpo_internalize_cred_label = mac_lomac_internalize_label,
-	.mpo_internalize_ifnet_label = mac_lomac_internalize_label,
-	.mpo_internalize_pipe_label = mac_lomac_internalize_label,
-	.mpo_internalize_socket_label = mac_lomac_internalize_label,
-	.mpo_internalize_vnode_label = mac_lomac_internalize_label,
-	.mpo_create_devfs_device = mac_lomac_create_devfs_device,
-	.mpo_create_devfs_directory = mac_lomac_create_devfs_directory,
-	.mpo_create_devfs_symlink = mac_lomac_create_devfs_symlink,
-	.mpo_create_mount = mac_lomac_create_mount,
-	.mpo_relabel_vnode = mac_lomac_relabel_vnode,
-	.mpo_update_devfs = mac_lomac_update_devfs,
-	.mpo_associate_vnode_devfs = mac_lomac_associate_vnode_devfs,
-	.mpo_associate_vnode_extattr = mac_lomac_associate_vnode_extattr,
-	.mpo_associate_vnode_singlelabel =
-	    mac_lomac_associate_vnode_singlelabel,
-	.mpo_create_vnode_extattr = mac_lomac_create_vnode_extattr,
-	.mpo_setlabel_vnode_extattr = mac_lomac_setlabel_vnode_extattr,
-	.mpo_create_mbuf_from_socket = mac_lomac_create_mbuf_from_socket,
-	.mpo_create_mbuf_from_syncache = mac_lomac_create_mbuf_from_syncache,
-	.mpo_create_pipe = mac_lomac_create_pipe,
-	.mpo_create_socket = mac_lomac_create_socket,
-	.mpo_create_socket_from_socket = mac_lomac_create_socket_from_socket,
-	.mpo_relabel_pipe = mac_lomac_relabel_pipe,
-	.mpo_relabel_socket = mac_lomac_relabel_socket,
-	.mpo_set_socket_peer_from_mbuf = mac_lomac_set_socket_peer_from_mbuf,
-	.mpo_set_socket_peer_from_socket =
-	    mac_lomac_set_socket_peer_from_socket,
-	.mpo_create_bpfdesc = mac_lomac_create_bpfdesc,
-	.mpo_create_datagram_from_ipq = mac_lomac_create_datagram_from_ipq,
-	.mpo_create_fragment = mac_lomac_create_fragment,
-	.mpo_create_ifnet = mac_lomac_create_ifnet,
-	.mpo_create_inpcb_from_socket = mac_lomac_create_inpcb_from_socket,
-	.mpo_create_ipq = mac_lomac_create_ipq,
-	.mpo_create_mbuf_from_inpcb = mac_lomac_create_mbuf_from_inpcb,
-	.mpo_create_mbuf_linklayer = mac_lomac_create_mbuf_linklayer,
-	.mpo_create_mbuf_from_bpfdesc = mac_lomac_create_mbuf_from_bpfdesc,
-	.mpo_create_mbuf_from_ifnet = mac_lomac_create_mbuf_from_ifnet,
-	.mpo_create_mbuf_multicast_encap =
-	    mac_lomac_create_mbuf_multicast_encap,
-	.mpo_create_mbuf_netlayer = mac_lomac_create_mbuf_netlayer,
-	.mpo_fragment_match = mac_lomac_fragment_match,
-	.mpo_relabel_ifnet = mac_lomac_relabel_ifnet,
-	.mpo_update_ipq = mac_lomac_update_ipq,
-	.mpo_inpcb_sosetlabel = mac_lomac_inpcb_sosetlabel,
-	.mpo_execve_transition = mac_lomac_execve_transition,
-	.mpo_execve_will_transition = mac_lomac_execve_will_transition,
-	.mpo_create_proc0 = mac_lomac_create_proc0,
-	.mpo_create_proc1 = mac_lomac_create_proc1,
-	.mpo_relabel_cred = mac_lomac_relabel_cred,
-	.mpo_check_bpfdesc_receive = mac_lomac_check_bpfdesc_receive,
-	.mpo_check_cred_relabel = mac_lomac_check_cred_relabel,
-	.mpo_check_cred_visible = mac_lomac_check_cred_visible,
-	.mpo_check_ifnet_relabel = mac_lomac_check_ifnet_relabel,
-	.mpo_check_ifnet_transmit = mac_lomac_check_ifnet_transmit,
-	.mpo_check_inpcb_deliver = mac_lomac_check_inpcb_deliver,
-	.mpo_check_kld_load = mac_lomac_check_kld_load,
-	.mpo_check_pipe_ioctl = mac_lomac_check_pipe_ioctl,
-	.mpo_check_pipe_read = mac_lomac_check_pipe_read,
-	.mpo_check_pipe_relabel = mac_lomac_check_pipe_relabel,
-	.mpo_check_pipe_write = mac_lomac_check_pipe_write,
-	.mpo_check_proc_debug = mac_lomac_check_proc_debug,
-	.mpo_check_proc_sched = mac_lomac_check_proc_sched,
-	.mpo_check_proc_signal = mac_lomac_check_proc_signal,
-	.mpo_check_socket_deliver = mac_lomac_check_socket_deliver,
-	.mpo_check_socket_relabel = mac_lomac_check_socket_relabel,
-	.mpo_check_socket_visible = mac_lomac_check_socket_visible,
-	.mpo_check_system_acct = mac_lomac_check_system_acct,
-	.mpo_check_system_auditctl = mac_lomac_check_system_auditctl,
-	.mpo_check_system_swapoff = mac_lomac_check_system_swapoff,
-	.mpo_check_system_swapon = mac_lomac_check_system_swapon,
-	.mpo_check_system_sysctl = mac_lomac_check_system_sysctl,
-	.mpo_check_vnode_access = mac_lomac_check_vnode_open,
-	.mpo_check_vnode_create = mac_lomac_check_vnode_create,
-	.mpo_check_vnode_deleteacl = mac_lomac_check_vnode_deleteacl,
-	.mpo_check_vnode_link = mac_lomac_check_vnode_link,
-	.mpo_check_vnode_mmap = mac_lomac_check_vnode_mmap,
-	.mpo_check_vnode_mmap_downgrade = mac_lomac_check_vnode_mmap_downgrade,
-	.mpo_check_vnode_open = mac_lomac_check_vnode_open,
-	.mpo_check_vnode_read = mac_lomac_check_vnode_read,
-	.mpo_check_vnode_relabel = mac_lomac_check_vnode_relabel,
-	.mpo_check_vnode_rename_from = mac_lomac_check_vnode_rename_from,
-	.mpo_check_vnode_rename_to = mac_lomac_check_vnode_rename_to,
-	.mpo_check_vnode_revoke = mac_lomac_check_vnode_revoke,
-	.mpo_check_vnode_setacl = mac_lomac_check_vnode_setacl,
-	.mpo_check_vnode_setextattr = mac_lomac_check_vnode_setextattr,
-	.mpo_check_vnode_setflags = mac_lomac_check_vnode_setflags,
-	.mpo_check_vnode_setmode = mac_lomac_check_vnode_setmode,
-	.mpo_check_vnode_setowner = mac_lomac_check_vnode_setowner,
-	.mpo_check_vnode_setutimes = mac_lomac_check_vnode_setutimes,
-	.mpo_check_vnode_unlink = mac_lomac_check_vnode_unlink,
-	.mpo_check_vnode_write = mac_lomac_check_vnode_write,
-	.mpo_thread_userret = mac_lomac_thread_userret,
-	.mpo_create_mbuf_from_firewall = mac_lomac_create_mbuf_from_firewall,
-	.mpo_priv_check = mac_lomac_priv_check,
+static struct mac_policy_ops lomac_ops =
+{
+	.mpo_init = lomac_init,
+	.mpo_init_bpfdesc_label = lomac_init_label,
+	.mpo_init_cred_label = lomac_init_label,
+	.mpo_init_devfs_label = lomac_init_label,
+	.mpo_init_ifnet_label = lomac_init_label,
+	.mpo_init_syncache_label = lomac_init_label_waitcheck,
+	.mpo_init_inpcb_label = lomac_init_label_waitcheck,
+	.mpo_init_ipq_label = lomac_init_label_waitcheck,
+	.mpo_init_mbuf_label = lomac_init_label_waitcheck,
+	.mpo_init_mount_label = lomac_init_label,
+	.mpo_init_pipe_label = lomac_init_label,
+	.mpo_init_proc_label = lomac_init_proc_label,
+	.mpo_init_socket_label = lomac_init_label_waitcheck,
+	.mpo_init_socket_peer_label = lomac_init_label_waitcheck,
+	.mpo_init_vnode_label = lomac_init_label,
+	.mpo_init_syncache_from_inpcb = lomac_init_syncache_from_inpcb,
+	.mpo_destroy_bpfdesc_label = lomac_destroy_label,
+	.mpo_destroy_cred_label = lomac_destroy_label,
+	.mpo_destroy_devfs_label = lomac_destroy_label,
+	.mpo_destroy_ifnet_label = lomac_destroy_label,
+	.mpo_destroy_inpcb_label = lomac_destroy_label,
+	.mpo_destroy_ipq_label = lomac_destroy_label,
+	.mpo_destroy_mbuf_label = lomac_destroy_label,
+	.mpo_destroy_mount_label = lomac_destroy_label,
+	.mpo_destroy_pipe_label = lomac_destroy_label,
+	.mpo_destroy_proc_label = lomac_destroy_proc_label,
+	.mpo_destroy_syncache_label = lomac_destroy_label,
+	.mpo_destroy_socket_label = lomac_destroy_label,
+	.mpo_destroy_socket_peer_label = lomac_destroy_label,
+	.mpo_destroy_vnode_label = lomac_destroy_label,
+	.mpo_copy_cred_label = lomac_copy_label,
+	.mpo_copy_ifnet_label = lomac_copy_label,
+	.mpo_copy_mbuf_label = lomac_copy_label,
+	.mpo_copy_pipe_label = lomac_copy_label,
+	.mpo_copy_socket_label = lomac_copy_label,
+	.mpo_copy_vnode_label = lomac_copy_label,
+	.mpo_externalize_cred_label = lomac_externalize_label,
+	.mpo_externalize_ifnet_label = lomac_externalize_label,
+	.mpo_externalize_pipe_label = lomac_externalize_label,
+	.mpo_externalize_socket_label = lomac_externalize_label,
+	.mpo_externalize_socket_peer_label = lomac_externalize_label,
+	.mpo_externalize_vnode_label = lomac_externalize_label,
+	.mpo_internalize_cred_label = lomac_internalize_label,
+	.mpo_internalize_ifnet_label = lomac_internalize_label,
+	.mpo_internalize_pipe_label = lomac_internalize_label,
+	.mpo_internalize_socket_label = lomac_internalize_label,
+	.mpo_internalize_vnode_label = lomac_internalize_label,
+	.mpo_create_devfs_device = lomac_create_devfs_device,
+	.mpo_create_devfs_directory = lomac_create_devfs_directory,
+	.mpo_create_devfs_symlink = lomac_create_devfs_symlink,
+	.mpo_create_mount = lomac_create_mount,
+	.mpo_relabel_vnode = lomac_relabel_vnode,
+	.mpo_update_devfs = lomac_update_devfs,
+	.mpo_associate_vnode_devfs = lomac_associate_vnode_devfs,
+	.mpo_associate_vnode_extattr = lomac_associate_vnode_extattr,
+	.mpo_associate_vnode_singlelabel = lomac_associate_vnode_singlelabel,
+	.mpo_create_vnode_extattr = lomac_create_vnode_extattr,
+	.mpo_setlabel_vnode_extattr = lomac_setlabel_vnode_extattr,
+	.mpo_create_mbuf_from_socket = lomac_create_mbuf_from_socket,
+	.mpo_create_mbuf_from_syncache = lomac_create_mbuf_from_syncache,
+	.mpo_create_pipe = lomac_create_pipe,
+	.mpo_create_socket = lomac_create_socket,
+	.mpo_create_socket_from_socket = lomac_create_socket_from_socket,
+	.mpo_relabel_pipe = lomac_relabel_pipe,
+	.mpo_relabel_socket = lomac_relabel_socket,
+	.mpo_set_socket_peer_from_mbuf = lomac_set_socket_peer_from_mbuf,
+	.mpo_set_socket_peer_from_socket = lomac_set_socket_peer_from_socket,
+	.mpo_create_bpfdesc = lomac_create_bpfdesc,
+	.mpo_create_datagram_from_ipq = lomac_create_datagram_from_ipq,
+	.mpo_create_fragment = lomac_create_fragment,
+	.mpo_create_ifnet = lomac_create_ifnet,
+	.mpo_create_inpcb_from_socket = lomac_create_inpcb_from_socket,
+	.mpo_create_ipq = lomac_create_ipq,
+	.mpo_create_mbuf_from_inpcb = lomac_create_mbuf_from_inpcb,
+	.mpo_create_mbuf_linklayer = lomac_create_mbuf_linklayer,
+	.mpo_create_mbuf_from_bpfdesc = lomac_create_mbuf_from_bpfdesc,
+	.mpo_create_mbuf_from_ifnet = lomac_create_mbuf_from_ifnet,
+	.mpo_create_mbuf_multicast_encap = lomac_create_mbuf_multicast_encap,
+	.mpo_create_mbuf_netlayer = lomac_create_mbuf_netlayer,
+	.mpo_fragment_match = lomac_fragment_match,
+	.mpo_relabel_ifnet = lomac_relabel_ifnet,
+	.mpo_update_ipq = lomac_update_ipq,
+	.mpo_inpcb_sosetlabel = lomac_inpcb_sosetlabel,
+	.mpo_execve_transition = lomac_execve_transition,
+	.mpo_execve_will_transition = lomac_execve_will_transition,
+	.mpo_create_proc0 = lomac_create_proc0,
+	.mpo_create_proc1 = lomac_create_proc1,
+	.mpo_relabel_cred = lomac_relabel_cred,
+	.mpo_check_bpfdesc_receive = lomac_check_bpfdesc_receive,
+	.mpo_check_cred_relabel = lomac_check_cred_relabel,
+	.mpo_check_cred_visible = lomac_check_cred_visible,
+	.mpo_check_ifnet_relabel = lomac_check_ifnet_relabel,
+	.mpo_check_ifnet_transmit = lomac_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = lomac_check_inpcb_deliver,
+	.mpo_check_kld_load = lomac_check_kld_load,
+	.mpo_check_pipe_ioctl = lomac_check_pipe_ioctl,
+	.mpo_check_pipe_read = lomac_check_pipe_read,
+	.mpo_check_pipe_relabel = lomac_check_pipe_relabel,
+	.mpo_check_pipe_write = lomac_check_pipe_write,
+	.mpo_check_proc_debug = lomac_check_proc_debug,
+	.mpo_check_proc_sched = lomac_check_proc_sched,
+	.mpo_check_proc_signal = lomac_check_proc_signal,
+	.mpo_check_socket_deliver = lomac_check_socket_deliver,
+	.mpo_check_socket_relabel = lomac_check_socket_relabel,
+	.mpo_check_socket_visible = lomac_check_socket_visible,
+	.mpo_check_system_acct = lomac_check_system_acct,
+	.mpo_check_system_auditctl = lomac_check_system_auditctl,
+	.mpo_check_system_swapoff = lomac_check_system_swapoff,
+	.mpo_check_system_swapon = lomac_check_system_swapon,
+	.mpo_check_system_sysctl = lomac_check_system_sysctl,
+	.mpo_check_vnode_access = lomac_check_vnode_open,
+	.mpo_check_vnode_create = lomac_check_vnode_create,
+	.mpo_check_vnode_deleteacl = lomac_check_vnode_deleteacl,
+	.mpo_check_vnode_link = lomac_check_vnode_link,
+	.mpo_check_vnode_mmap = lomac_check_vnode_mmap,
+	.mpo_check_vnode_mmap_downgrade = lomac_check_vnode_mmap_downgrade,
+	.mpo_check_vnode_open = lomac_check_vnode_open,
+	.mpo_check_vnode_read = lomac_check_vnode_read,
+	.mpo_check_vnode_relabel = lomac_check_vnode_relabel,
+	.mpo_check_vnode_rename_from = lomac_check_vnode_rename_from,
+	.mpo_check_vnode_rename_to = lomac_check_vnode_rename_to,
+	.mpo_check_vnode_revoke = lomac_check_vnode_revoke,
+	.mpo_check_vnode_setacl = lomac_check_vnode_setacl,
+	.mpo_check_vnode_setextattr = lomac_check_vnode_setextattr,
+	.mpo_check_vnode_setflags = lomac_check_vnode_setflags,
+	.mpo_check_vnode_setmode = lomac_check_vnode_setmode,
+	.mpo_check_vnode_setowner = lomac_check_vnode_setowner,
+	.mpo_check_vnode_setutimes = lomac_check_vnode_setutimes,
+	.mpo_check_vnode_unlink = lomac_check_vnode_unlink,
+	.mpo_check_vnode_write = lomac_check_vnode_write,
+	.mpo_thread_userret = lomac_thread_userret,
+	.mpo_create_mbuf_from_firewall = lomac_create_mbuf_from_firewall,
+	.mpo_priv_check = lomac_priv_check,
 };
 
-MAC_POLICY_SET(&mac_lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC",
-    MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS,
-    &mac_lomac_slot);
+MAC_POLICY_SET(&lomac_ops, mac_lomac, "TrustedBSD MAC/LOMAC",
+    MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &lomac_slot);
diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c
index fda980baf9db..0d2dafe4694f 100644
--- a/sys/security/mac_mls/mac_mls.c
+++ b/sys/security/mac_mls/mac_mls.c
@@ -89,14 +89,14 @@ SYSCTL_DECL(_security_mac);
 SYSCTL_NODE(_security_mac, OID_AUTO, mls, CTLFLAG_RW, 0,
     "TrustedBSD mac_mls policy controls");
 
-static int	mac_mls_label_size = sizeof(struct mac_mls);
+static int	mls_label_size = sizeof(struct mac_mls);
 SYSCTL_INT(_security_mac_mls, OID_AUTO, label_size, CTLFLAG_RD,
-    &mac_mls_label_size, 0, "Size of struct mac_mls");
+    &mls_label_size, 0, "Size of struct mac_mls");
 
-static int	mac_mls_enabled = 1;
-SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_mls_enabled, 0, "Enforce MAC/MLS policy");
-TUNABLE_INT("security.mac.mls.enabled", &mac_mls_enabled);
+static int	mls_enabled = 1;
+SYSCTL_INT(_security_mac_mls, OID_AUTO, enabled, CTLFLAG_RW, &mls_enabled, 0,
+    "Enforce MAC/MLS policy");
+TUNABLE_INT("security.mac.mls.enabled", &mls_enabled);
 
 static int	destroyed_not_inited;
 SYSCTL_INT(_security_mac_mls, OID_AUTO, destroyed_not_inited, CTLFLAG_RD,
@@ -116,9 +116,9 @@ static int	max_compartments = MAC_MLS_MAX_COMPARTMENTS;
 SYSCTL_INT(_security_mac_mls, OID_AUTO, max_compartments, CTLFLAG_RD,
     &max_compartments, 0, "Maximum compartments the policy supports");
 
-static int	mac_mls_slot;
-#define	SLOT(l)	((struct mac_mls *)mac_label_get((l), mac_mls_slot))
-#define	SLOT_SET(l, val) mac_label_set((l), mac_mls_slot, (uintptr_t)(val))
+static int	mls_slot;
+#define	SLOT(l)	((struct mac_mls *)mac_label_get((l), mls_slot))
+#define	SLOT_SET(l, val) mac_label_set((l), mls_slot, (uintptr_t)(val))
 
 static uma_zone_t	zone_mls;
 
@@ -140,27 +140,26 @@ mls_alloc(int flag)
 }
 
 static void
-mls_free(struct mac_mls *mac_mls)
+mls_free(struct mac_mls *mm)
 {
 
-	if (mac_mls != NULL)
-		uma_zfree(zone_mls, mac_mls);
+	if (mm != NULL)
+		uma_zfree(zone_mls, mm);
 	else
 		atomic_add_int(&destroyed_not_inited, 1);
 }
 
 static int
-mls_atmostflags(struct mac_mls *mac_mls, int flags)
+mls_atmostflags(struct mac_mls *mm, int flags)
 {
 
-	if ((mac_mls->mm_flags & flags) != mac_mls->mm_flags)
+	if ((mm->mm_flags & flags) != mm->mm_flags)
 		return (EINVAL);
 	return (0);
 }
 
 static int
-mac_mls_dominate_element(struct mac_mls_element *a,
-    struct mac_mls_element *b)
+mls_dominate_element(struct mac_mls_element *a, struct mac_mls_element *b)
 {
 	int bit;
 
@@ -180,7 +179,7 @@ mac_mls_dominate_element(struct mac_mls_element *a,
 			return (1);
 
 		default:
-			panic("mac_mls_dominate_element: b->mme_type invalid");
+			panic("mls_dominate_element: b->mme_type invalid");
 		}
 
 	case MAC_MLS_TYPE_LEVEL:
@@ -201,56 +200,56 @@ mac_mls_dominate_element(struct mac_mls_element *a,
 			return (a->mme_level >= b->mme_level);
 
 		default:
-			panic("mac_mls_dominate_element: b->mme_type invalid");
+			panic("mls_dominate_element: b->mme_type invalid");
 		}
 
 	default:
-		panic("mac_mls_dominate_element: a->mme_type invalid");
+		panic("mls_dominate_element: a->mme_type invalid");
 	}
 
 	return (0);
 }
 
 static int
-mac_mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb)
+mls_range_in_range(struct mac_mls *rangea, struct mac_mls *rangeb)
 {
 
-	return (mac_mls_dominate_element(&rangeb->mm_rangehigh,
+	return (mls_dominate_element(&rangeb->mm_rangehigh,
 	    &rangea->mm_rangehigh) &&
-	    mac_mls_dominate_element(&rangea->mm_rangelow,
+	    mls_dominate_element(&rangea->mm_rangelow,
 	    &rangeb->mm_rangelow));
 }
 
 static int
-mac_mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range)
+mls_effective_in_range(struct mac_mls *effective, struct mac_mls *range)
 {
 
 	KASSERT((effective->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
-	    ("mac_mls_effective_in_range: a not effective"));
+	    ("mls_effective_in_range: a not effective"));
 	KASSERT((range->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
-	    ("mac_mls_effective_in_range: b not range"));
+	    ("mls_effective_in_range: b not range"));
 
-	return (mac_mls_dominate_element(&range->mm_rangehigh,
+	return (mls_dominate_element(&range->mm_rangehigh,
 	    &effective->mm_effective) &&
-	    mac_mls_dominate_element(&effective->mm_effective,
+	    mls_dominate_element(&effective->mm_effective,
 	    &range->mm_rangelow));
 
 	return (1);
 }
 
 static int
-mac_mls_dominate_effective(struct mac_mls *a, struct mac_mls *b)
+mls_dominate_effective(struct mac_mls *a, struct mac_mls *b)
 {
 	KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
-	    ("mac_mls_dominate_effective: a not effective"));
+	    ("mls_dominate_effective: a not effective"));
 	KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
-	    ("mac_mls_dominate_effective: b not effective"));
+	    ("mls_dominate_effective: b not effective"));
 
-	return (mac_mls_dominate_element(&a->mm_effective, &b->mm_effective));
+	return (mls_dominate_element(&a->mm_effective, &b->mm_effective));
 }
 
 static int
-mac_mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b)
+mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b)
 {
 
 	if (a->mme_type == MAC_MLS_TYPE_EQUAL ||
@@ -261,29 +260,29 @@ mac_mls_equal_element(struct mac_mls_element *a, struct mac_mls_element *b)
 }
 
 static int
-mac_mls_equal_effective(struct mac_mls *a, struct mac_mls *b)
+mls_equal_effective(struct mac_mls *a, struct mac_mls *b)
 {
 
 	KASSERT((a->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
-	    ("mac_mls_equal_effective: a not effective"));
+	    ("mls_equal_effective: a not effective"));
 	KASSERT((b->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
-	    ("mac_mls_equal_effective: b not effective"));
+	    ("mls_equal_effective: b not effective"));
 
-	return (mac_mls_equal_element(&a->mm_effective, &b->mm_effective));
+	return (mls_equal_element(&a->mm_effective, &b->mm_effective));
 }
 
 static int
-mac_mls_contains_equal(struct mac_mls *mac_mls)
+mls_contains_equal(struct mac_mls *mm)
 {
 
-	if (mac_mls->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
-		if (mac_mls->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
+	if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
+		if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
 			return (1);
 
-	if (mac_mls->mm_flags & MAC_MLS_FLAG_RANGE) {
-		if (mac_mls->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL)
+	if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
+		if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL)
 			return (1);
-		if (mac_mls->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
+		if (mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
 			return (1);
 	}
 
@@ -291,25 +290,24 @@ mac_mls_contains_equal(struct mac_mls *mac_mls)
 }
 
 static int
-mac_mls_subject_privileged(struct mac_mls *mac_mls)
+mls_subject_privileged(struct mac_mls *mm)
 {
 
-	KASSERT((mac_mls->mm_flags & MAC_MLS_FLAGS_BOTH) ==
-	    MAC_MLS_FLAGS_BOTH,
-	    ("mac_mls_subject_privileged: subject doesn't have both labels"));
+	KASSERT((mm->mm_flags & MAC_MLS_FLAGS_BOTH) == MAC_MLS_FLAGS_BOTH,
+	    ("mls_subject_privileged: subject doesn't have both labels"));
 
 	/* If the effective is EQUAL, it's ok. */
-	if (mac_mls->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
+	if (mm->mm_effective.mme_type == MAC_MLS_TYPE_EQUAL)
 		return (0);
 
 	/* If either range endpoint is EQUAL, it's ok. */
-	if (mac_mls->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL ||
-	    mac_mls->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
+	if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_EQUAL ||
+	    mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_EQUAL)
 		return (0);
 
 	/* If the range is low-high, it's ok. */
-	if (mac_mls->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW &&
-	    mac_mls->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH)
+	if (mm->mm_rangelow.mme_type == MAC_MLS_TYPE_LOW &&
+	    mm->mm_rangehigh.mme_type == MAC_MLS_TYPE_HIGH)
 		return (0);
 
 	/* It's not ok. */
@@ -317,20 +315,20 @@ mac_mls_subject_privileged(struct mac_mls *mac_mls)
 }
 
 static int
-mac_mls_valid(struct mac_mls *mac_mls)
+mls_valid(struct mac_mls *mm)
 {
 
-	if (mac_mls->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
-		switch (mac_mls->mm_effective.mme_type) {
+	if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
+		switch (mm->mm_effective.mme_type) {
 		case MAC_MLS_TYPE_LEVEL:
 			break;
 
 		case MAC_MLS_TYPE_EQUAL:
 		case MAC_MLS_TYPE_HIGH:
 		case MAC_MLS_TYPE_LOW:
-			if (mac_mls->mm_effective.mme_level != 0 ||
+			if (mm->mm_effective.mme_level != 0 ||
 			    !MAC_MLS_BIT_SET_EMPTY(
-			    mac_mls->mm_effective.mme_compartments))
+			    mm->mm_effective.mme_compartments))
 				return (EINVAL);
 			break;
 
@@ -338,21 +336,21 @@ mac_mls_valid(struct mac_mls *mac_mls)
 			return (EINVAL);
 		}
 	} else {
-		if (mac_mls->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF)
+		if (mm->mm_effective.mme_type != MAC_MLS_TYPE_UNDEF)
 			return (EINVAL);
 	}
 
-	if (mac_mls->mm_flags & MAC_MLS_FLAG_RANGE) {
-		switch (mac_mls->mm_rangelow.mme_type) {
+	if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
+		switch (mm->mm_rangelow.mme_type) {
 		case MAC_MLS_TYPE_LEVEL:
 			break;
 
 		case MAC_MLS_TYPE_EQUAL:
 		case MAC_MLS_TYPE_HIGH:
 		case MAC_MLS_TYPE_LOW:
-			if (mac_mls->mm_rangelow.mme_level != 0 ||
+			if (mm->mm_rangelow.mme_level != 0 ||
 			    !MAC_MLS_BIT_SET_EMPTY(
-			    mac_mls->mm_rangelow.mme_compartments))
+			    mm->mm_rangelow.mme_compartments))
 				return (EINVAL);
 			break;
 
@@ -360,28 +358,28 @@ mac_mls_valid(struct mac_mls *mac_mls)
 			return (EINVAL);
 		}
 
-		switch (mac_mls->mm_rangehigh.mme_type) {
+		switch (mm->mm_rangehigh.mme_type) {
 		case MAC_MLS_TYPE_LEVEL:
 			break;
 
 		case MAC_MLS_TYPE_EQUAL:
 		case MAC_MLS_TYPE_HIGH:
 		case MAC_MLS_TYPE_LOW:
-			if (mac_mls->mm_rangehigh.mme_level != 0 ||
+			if (mm->mm_rangehigh.mme_level != 0 ||
 			    !MAC_MLS_BIT_SET_EMPTY(
-			    mac_mls->mm_rangehigh.mme_compartments))
+			    mm->mm_rangehigh.mme_compartments))
 				return (EINVAL);
 			break;
 
 		default:
 			return (EINVAL);
 		}
-		if (!mac_mls_dominate_element(&mac_mls->mm_rangehigh,
-		    &mac_mls->mm_rangelow))
+		if (!mls_dominate_element(&mm->mm_rangehigh,
+		    &mm->mm_rangelow))
 			return (EINVAL);
 	} else {
-		if (mac_mls->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF ||
-		    mac_mls->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF)
+		if (mm->mm_rangelow.mme_type != MAC_MLS_TYPE_UNDEF ||
+		    mm->mm_rangehigh.mme_type != MAC_MLS_TYPE_UNDEF)
 			return (EINVAL);
 	}
 
@@ -389,45 +387,43 @@ mac_mls_valid(struct mac_mls *mac_mls)
 }
 
 static void
-mac_mls_set_range(struct mac_mls *mac_mls, u_short typelow,
-    u_short levellow, u_char *compartmentslow, u_short typehigh,
-    u_short levelhigh, u_char *compartmentshigh)
+mls_set_range(struct mac_mls *mm, u_short typelow, u_short levellow,
+    u_char *compartmentslow, u_short typehigh, u_short levelhigh,
+    u_char *compartmentshigh)
 {
 
-	mac_mls->mm_rangelow.mme_type = typelow;
-	mac_mls->mm_rangelow.mme_level = levellow;
+	mm->mm_rangelow.mme_type = typelow;
+	mm->mm_rangelow.mme_level = levellow;
 	if (compartmentslow != NULL)
-		memcpy(mac_mls->mm_rangelow.mme_compartments,
-		    compartmentslow,
-		    sizeof(mac_mls->mm_rangelow.mme_compartments));
-	mac_mls->mm_rangehigh.mme_type = typehigh;
-	mac_mls->mm_rangehigh.mme_level = levelhigh;
+		memcpy(mm->mm_rangelow.mme_compartments, compartmentslow,
+		    sizeof(mm->mm_rangelow.mme_compartments));
+	mm->mm_rangehigh.mme_type = typehigh;
+	mm->mm_rangehigh.mme_level = levelhigh;
 	if (compartmentshigh != NULL)
-		memcpy(mac_mls->mm_rangehigh.mme_compartments,
-		    compartmentshigh,
-		    sizeof(mac_mls->mm_rangehigh.mme_compartments));
-	mac_mls->mm_flags |= MAC_MLS_FLAG_RANGE;
+		memcpy(mm->mm_rangehigh.mme_compartments, compartmentshigh,
+		    sizeof(mm->mm_rangehigh.mme_compartments));
+	mm->mm_flags |= MAC_MLS_FLAG_RANGE;
 }
 
 static void
-mac_mls_set_effective(struct mac_mls *mac_mls, u_short type, u_short level,
+mls_set_effective(struct mac_mls *mm, u_short type, u_short level,
     u_char *compartments)
 {
 
-	mac_mls->mm_effective.mme_type = type;
-	mac_mls->mm_effective.mme_level = level;
+	mm->mm_effective.mme_type = type;
+	mm->mm_effective.mme_level = level;
 	if (compartments != NULL)
-		memcpy(mac_mls->mm_effective.mme_compartments, compartments,
-		    sizeof(mac_mls->mm_effective.mme_compartments));
-	mac_mls->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
+		memcpy(mm->mm_effective.mme_compartments, compartments,
+		    sizeof(mm->mm_effective.mme_compartments));
+	mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
 }
 
 static void
-mac_mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto)
+mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto)
 {
 
 	KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_RANGE) != 0,
-	    ("mac_mls_copy_range: labelfrom not range"));
+	    ("mls_copy_range: labelfrom not range"));
 
 	labelto->mm_rangelow = labelfrom->mm_rangelow;
 	labelto->mm_rangehigh = labelfrom->mm_rangehigh;
@@ -435,31 +431,31 @@ mac_mls_copy_range(struct mac_mls *labelfrom, struct mac_mls *labelto)
 }
 
 static void
-mac_mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto)
+mls_copy_effective(struct mac_mls *labelfrom, struct mac_mls *labelto)
 {
 
 	KASSERT((labelfrom->mm_flags & MAC_MLS_FLAG_EFFECTIVE) != 0,
-	    ("mac_mls_copy_effective: labelfrom not effective"));
+	    ("mls_copy_effective: labelfrom not effective"));
 
 	labelto->mm_effective = labelfrom->mm_effective;
 	labelto->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
 }
 
 static void
-mac_mls_copy(struct mac_mls *source, struct mac_mls *dest)
+mls_copy(struct mac_mls *source, struct mac_mls *dest)
 {
 
 	if (source->mm_flags & MAC_MLS_FLAG_EFFECTIVE)
-		mac_mls_copy_effective(source, dest);
+		mls_copy_effective(source, dest);
 	if (source->mm_flags & MAC_MLS_FLAG_RANGE)
-		mac_mls_copy_range(source, dest);
+		mls_copy_range(source, dest);
 }
 
 /*
  * Policy module operations.
  */
 static void
-mac_mls_init(struct mac_policy_conf *conf)
+mls_init(struct mac_policy_conf *conf)
 {
 
 	zone_mls = uma_zcreate("mac_mls", sizeof(struct mac_mls), NULL,
@@ -470,14 +466,14 @@ mac_mls_init(struct mac_policy_conf *conf)
  * Label operations.
  */
 static void
-mac_mls_init_label(struct label *label)
+mls_init_label(struct label *label)
 {
 
 	SLOT_SET(label, mls_alloc(M_WAITOK));
 }
 
 static int
-mac_mls_init_label_waitcheck(struct label *label, int flag)
+mls_init_label_waitcheck(struct label *label, int flag)
 {
 
 	SLOT_SET(label, mls_alloc(flag));
@@ -488,7 +484,7 @@ mac_mls_init_label_waitcheck(struct label *label, int flag)
 }
 
 static void
-mac_mls_destroy_label(struct label *label)
+mls_destroy_label(struct label *label)
 {
 
 	mls_free(SLOT(label));
@@ -496,12 +492,12 @@ mac_mls_destroy_label(struct label *label)
 }
 
 /*
- * mac_mls_element_to_string() accepts an sbuf and MLS element.  It
- * converts the MLS element to a string and stores the result in the
- * sbuf; if there isn't space in the sbuf, -1 is returned.
+ * mls_element_to_string() accepts an sbuf and MLS element.  It converts the
+ * MLS element to a string and stores the result in the sbuf; if there isn't
+ * space in the sbuf, -1 is returned.
  */
 static int
-mac_mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element)
+mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element)
 {
 	int i, first;
 
@@ -537,41 +533,38 @@ mac_mls_element_to_string(struct sbuf *sb, struct mac_mls_element *element)
 		return (0);
 
 	default:
-		panic("mac_mls_element_to_string: invalid type (%d)",
+		panic("mls_element_to_string: invalid type (%d)",
 		    element->mme_type);
 	}
 }
 
 /*
- * mac_mls_to_string() converts an MLS label to a string, and places
- * the results in the passed sbuf.  It returns 0 on success, or EINVAL
- * if there isn't room in the sbuf.  Note: the sbuf will be modified
- * even in a failure case, so the caller may need to revert the sbuf
- * by restoring the offset if that's undesired.
+ * mls_to_string() converts an MLS label to a string, and places the results
+ * in the passed sbuf.  It returns 0 on success, or EINVAL if there isn't
+ * room in the sbuf.  Note: the sbuf will be modified even in a failure case,
+ * so the caller may need to revert the sbuf by restoring the offset if
+ * that's undesired.
  */
 static int
-mac_mls_to_string(struct sbuf *sb, struct mac_mls *mac_mls)
+mls_to_string(struct sbuf *sb, struct mac_mls *mm)
 {
 
-	if (mac_mls->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
-		if (mac_mls_element_to_string(sb, &mac_mls->mm_effective)
-		    == -1)
+	if (mm->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
+		if (mls_element_to_string(sb, &mm->mm_effective) == -1)
 			return (EINVAL);
 	}
 
-	if (mac_mls->mm_flags & MAC_MLS_FLAG_RANGE) {
+	if (mm->mm_flags & MAC_MLS_FLAG_RANGE) {
 		if (sbuf_putc(sb, '(') == -1)
 			return (EINVAL);
 
-		if (mac_mls_element_to_string(sb, &mac_mls->mm_rangelow)
-		    == -1)
+		if (mls_element_to_string(sb, &mm->mm_rangelow) == -1)
 			return (EINVAL);
 
 		if (sbuf_putc(sb, '-') == -1)
 			return (EINVAL);
 
-		if (mac_mls_element_to_string(sb, &mac_mls->mm_rangehigh)
-		    == -1)
+		if (mls_element_to_string(sb, &mm->mm_rangehigh) == -1)
 			return (EINVAL);
 
 		if (sbuf_putc(sb, ')') == -1)
@@ -582,33 +575,31 @@ mac_mls_to_string(struct sbuf *sb, struct mac_mls *mac_mls)
 }
 
 static int
-mac_mls_externalize_label(struct label *label, char *element_name,
+mls_externalize_label(struct label *label, char *element_name,
     struct sbuf *sb, int *claimed)
 {
-	struct mac_mls *mac_mls;
+	struct mac_mls *mm;
 
 	if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
 		return (0);
 
 	(*claimed)++;
 
-	mac_mls = SLOT(label);
+	mm = SLOT(label);
 
-	return (mac_mls_to_string(sb, mac_mls));
+	return (mls_to_string(sb, mm));
 }
 
 static int
-mac_mls_parse_element(struct mac_mls_element *element, char *string)
+mls_parse_element(struct mac_mls_element *element, char *string)
 {
 	char *compartment, *end, *level;
 	int value;
 
-	if (strcmp(string, "high") == 0 ||
-	    strcmp(string, "hi") == 0) {
+	if (strcmp(string, "high") == 0 || strcmp(string, "hi") == 0) {
 		element->mme_type = MAC_MLS_TYPE_HIGH;
 		element->mme_level = MAC_MLS_TYPE_UNDEF;
-	} else if (strcmp(string, "low") == 0 ||
-	    strcmp(string, "lo") == 0) {
+	} else if (strcmp(string, "low") == 0 || strcmp(string, "lo") == 0) {
 		element->mme_type = MAC_MLS_TYPE_LOW;
 		element->mme_level = MAC_MLS_TYPE_UNDEF;
 	} else if (strcmp(string, "equal") == 0 ||
@@ -630,9 +621,8 @@ mac_mls_parse_element(struct mac_mls_element *element, char *string)
 		element->mme_level = value;
 
 		/*
-		 * Optional compartment piece of the element.  If none
-		 * are included, we assume that the label has no
-		 * compartments.
+		 * Optional compartment piece of the element.  If none are
+		 * included, we assume that the label has no compartments.
 		 */
 		if (string == NULL)
 			return (0);
@@ -653,11 +643,11 @@ mac_mls_parse_element(struct mac_mls_element *element, char *string)
 }
 
 /*
- * Note: destructively consumes the string, make a local copy before
- * calling if that's a problem.
+ * Note: destructively consumes the string, make a local copy before calling
+ * if that's a problem.
  */
 static int
-mac_mls_parse(struct mac_mls *mac_mls, char *string)
+mls_parse(struct mac_mls *mm, char *string)
 {
 	char *rangehigh, *rangelow, *effective;
 	int error;
@@ -682,29 +672,27 @@ mac_mls_parse(struct mac_mls *mac_mls, char *string)
 
 	KASSERT((rangelow != NULL && rangehigh != NULL) ||
 	    (rangelow == NULL && rangehigh == NULL),
-	    ("mac_mls_parse: range mismatch"));
+	    ("mls_parse: range mismatch"));
 
-	bzero(mac_mls, sizeof(*mac_mls));
+	bzero(mm, sizeof(*mm));
 	if (effective != NULL) {
-		error = mac_mls_parse_element(&mac_mls->mm_effective, effective);
+		error = mls_parse_element(&mm->mm_effective, effective);
 		if (error)
 			return (error);
-		mac_mls->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
+		mm->mm_flags |= MAC_MLS_FLAG_EFFECTIVE;
 	}
 
 	if (rangelow != NULL) {
-		error = mac_mls_parse_element(&mac_mls->mm_rangelow,
-		    rangelow);
+		error = mls_parse_element(&mm->mm_rangelow, rangelow);
 		if (error)
 			return (error);
-		error = mac_mls_parse_element(&mac_mls->mm_rangehigh,
-		    rangehigh);
+		error = mls_parse_element(&mm->mm_rangehigh, rangehigh);
 		if (error)
 			return (error);
-		mac_mls->mm_flags |= MAC_MLS_FLAG_RANGE;
+		mm->mm_flags |= MAC_MLS_FLAG_RANGE;
 	}
 
-	error = mac_mls_valid(mac_mls);
+	error = mls_valid(mm);
 	if (error)
 		return (error);
 
@@ -712,10 +700,10 @@ mac_mls_parse(struct mac_mls *mac_mls, char *string)
 }
 
 static int
-mac_mls_internalize_label(struct label *label, char *element_name,
+mls_internalize_label(struct label *label, char *element_name,
     char *element_data, int *claimed)
 {
-	struct mac_mls *mac_mls, mac_mls_temp;
+	struct mac_mls *mm, mm_temp;
 	int error;
 
 	if (strcmp(MAC_MLS_LABEL_NAME, element_name) != 0)
@@ -723,35 +711,35 @@ mac_mls_internalize_label(struct label *label, char *element_name,
 
 	(*claimed)++;
 
-	error = mac_mls_parse(&mac_mls_temp, element_data);
+	error = mls_parse(&mm_temp, element_data);
 	if (error)
 		return (error);
 
-	mac_mls = SLOT(label);
-	*mac_mls = mac_mls_temp;
+	mm = SLOT(label);
+	*mm = mm_temp;
 
 	return (0);
 }
 
 static void
-mac_mls_copy_label(struct label *src, struct label *dest)
+mls_copy_label(struct label *src, struct label *dest)
 {
 
 	*SLOT(dest) = *SLOT(src);
 }
 
 /*
- * Labeling event operations: file system objects, and things that look
- * a lot like file system objects.
+ * Labeling event operations: file system objects, and things that look a lot
+ * like file system objects.
  */
 static void
-mac_mls_create_devfs_device(struct ucred *cred, struct mount *mp,
+mls_create_devfs_device(struct ucred *cred, struct mount *mp,
     struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
 {
-	struct mac_mls *mac_mls;
+	struct mac_mls *mm;
 	int mls_type;
 
-	mac_mls = SLOT(delabel);
+	mm = SLOT(delabel);
 	if (strcmp(dev->si_name, "null") == 0 ||
 	    strcmp(dev->si_name, "zero") == 0 ||
 	    strcmp(dev->si_name, "random") == 0 ||
@@ -766,21 +754,21 @@ mac_mls_create_devfs_device(struct ucred *cred, struct mount *mp,
 		mls_type = MAC_MLS_TYPE_EQUAL;
 	else
 		mls_type = MAC_MLS_TYPE_LOW;
-	mac_mls_set_effective(mac_mls, mls_type, 0, NULL);
+	mls_set_effective(mm, mls_type, 0, NULL);
 }
 
 static void
-mac_mls_create_devfs_directory(struct mount *mp, char *dirname,
-    int dirnamelen, struct devfs_dirent *de, struct label *delabel)
+mls_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
+    struct devfs_dirent *de, struct label *delabel)
 {
-	struct mac_mls *mac_mls;
+	struct mac_mls *mm;
 
-	mac_mls = SLOT(delabel);
-	mac_mls_set_effective(mac_mls, MAC_MLS_TYPE_LOW, 0, NULL);
+	mm = SLOT(delabel);
+	mls_set_effective(mm, MAC_MLS_TYPE_LOW, 0, NULL);
 }
 
 static void
-mac_mls_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+mls_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
     struct label *delabel)
 {
@@ -789,22 +777,22 @@ mac_mls_create_devfs_symlink(struct ucred *cred, struct mount *mp,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(delabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mount(struct ucred *cred, struct mount *mp,
-    struct label *mplabel)
+mls_create_mount(struct ucred *cred, struct mount *mp, struct label *mplabel)
 {
 	struct mac_mls *source, *dest;
 
 	source = SLOT(cred->cr_label);
 	dest = SLOT(mplabel);
-	mac_mls_copy_effective(source, dest);
+
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_relabel_vnode(struct ucred *cred, struct vnode *vp,
+mls_relabel_vnode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *label)
 {
 	struct mac_mls *source, *dest;
@@ -812,11 +800,11 @@ mac_mls_relabel_vnode(struct ucred *cred, struct vnode *vp,
 	source = SLOT(label);
 	dest = SLOT(vplabel);
 
-	mac_mls_copy(source, dest);
+	mls_copy(source, dest);
 }
 
 static void
-mac_mls_update_devfs(struct mount *mp, struct devfs_dirent *de,
+mls_update_devfs(struct mount *mp, struct devfs_dirent *de,
     struct label *delabel, struct vnode *vp, struct label *vplabel)
 {
 	struct mac_mls *source, *dest;
@@ -824,11 +812,11 @@ mac_mls_update_devfs(struct mount *mp, struct devfs_dirent *de,
 	source = SLOT(vplabel);
 	dest = SLOT(delabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
+mls_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
     struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
     struct label *vplabel)
 {
@@ -837,11 +825,11 @@ mac_mls_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
 	source = SLOT(delabel);
 	dest = SLOT(vplabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static int
-mac_mls_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
+mls_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_mls temp, *source, *dest;
@@ -857,43 +845,43 @@ mac_mls_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
 	    MAC_MLS_EXTATTR_NAME, &buflen, (char *) &temp, curthread);
 	if (error == ENOATTR || error == EOPNOTSUPP) {
 		/* Fall back to the mntlabel. */
-		mac_mls_copy_effective(source, dest);
+		mls_copy_effective(source, dest);
 		return (0);
 	} else if (error)
 		return (error);
 
 	if (buflen != sizeof(temp)) {
-		printf("mac_mls_associate_vnode_extattr: bad size %d\n",
+		printf("mls_associate_vnode_extattr: bad size %d\n",
 		    buflen);
 		return (EPERM);
 	}
-	if (mac_mls_valid(&temp) != 0) {
-		printf("mac_mls_associate_vnode_extattr: invalid\n");
+	if (mls_valid(&temp) != 0) {
+		printf("mls_associate_vnode_extattr: invalid\n");
 		return (EPERM);
 	}
 	if ((temp.mm_flags & MAC_MLS_FLAGS_BOTH) != MAC_MLS_FLAG_EFFECTIVE) {
-		printf("mac_mls_associated_vnode_extattr: not effective\n");
+		printf("mls_associated_vnode_extattr: not effective\n");
 		return (EPERM);
 	}
 
-	mac_mls_copy_effective(&temp, dest);
+	mls_copy_effective(&temp, dest);
 	return (0);
 }
 
 static void
-mac_mls_associate_vnode_singlelabel(struct mount *mp,
-    struct label *mplabel, struct vnode *vp, struct label *vplabel)
+mls_associate_vnode_singlelabel(struct mount *mp, struct label *mplabel,
+    struct vnode *vp, struct label *vplabel)
 {
 	struct mac_mls *source, *dest;
 
 	source = SLOT(mplabel);
 	dest = SLOT(vplabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static int
-mac_mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
+mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
     struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
     struct vnode *vp, struct label *vplabel, struct componentname *cnp)
 {
@@ -906,17 +894,17 @@ mac_mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 
 	source = SLOT(cred->cr_label);
 	dest = SLOT(vplabel);
-	mac_mls_copy_effective(source, &temp);
+	mls_copy_effective(source, &temp);
 
 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
 	    MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread);
 	if (error == 0)
-		mac_mls_copy_effective(source, dest);
+		mls_copy_effective(source, dest);
 	return (error);
 }
 
 static int
-mac_mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
+mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *intlabel)
 {
 	struct mac_mls *source, temp;
@@ -930,7 +918,7 @@ mac_mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
 	if ((source->mm_flags & MAC_MLS_FLAG_EFFECTIVE) == 0)
 		return (0);
 
-	mac_mls_copy_effective(source, &temp);
+	mls_copy_effective(source, &temp);
 
 	error = vn_extattr_set(vp, IO_NODELOCKED, MAC_MLS_EXTATTR_NAMESPACE,
 	    MAC_MLS_EXTATTR_NAME, buflen, (char *) &temp, curthread);
@@ -941,7 +929,7 @@ mac_mls_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
  * Labeling event operations: IPC object.
  */
 static void
-mac_mls_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+mls_create_inpcb_from_socket(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 	struct mac_mls *source, *dest;
@@ -949,11 +937,11 @@ mac_mls_create_inpcb_from_socket(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(inplabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_from_socket(struct socket *so, struct label *solabel,
+mls_create_mbuf_from_socket(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *source, *dest;
@@ -961,11 +949,11 @@ mac_mls_create_mbuf_from_socket(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(mlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_socket(struct ucred *cred, struct socket *so,
+mls_create_socket(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 	struct mac_mls *source, *dest;
@@ -973,11 +961,11 @@ mac_mls_create_socket(struct ucred *cred, struct socket *so,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(solabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_pipe(struct ucred *cred, struct pipepair *pp,
+mls_create_pipe(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_mls *source, *dest;
@@ -985,11 +973,11 @@ mac_mls_create_pipe(struct ucred *cred, struct pipepair *pp,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(pplabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_posix_sem(struct ucred *cred, struct ksem *ks,
+mls_create_posix_sem(struct ucred *cred, struct ksem *ks,
     struct label *kslabel)
 {
 	struct mac_mls *source, *dest;
@@ -997,23 +985,23 @@ mac_mls_create_posix_sem(struct ucred *cred, struct ksem *ks,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(kslabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_socket_from_socket(struct socket *oldso,
-    struct label *oldsolabel, struct socket *newso, struct label *newsolabel)
+mls_create_socket_from_socket(struct socket *oldso, struct label *oldsolabel,
+    struct socket *newso, struct label *newsolabel)
 {
 	struct mac_mls *source, *dest;
 
 	source = SLOT(oldsolabel);
 	dest = SLOT(newsolabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_relabel_socket(struct ucred *cred, struct socket *so,
+mls_relabel_socket(struct ucred *cred, struct socket *so,
     struct label *solabel, struct label *newlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1021,11 +1009,11 @@ mac_mls_relabel_socket(struct ucred *cred, struct socket *so,
 	source = SLOT(newlabel);
 	dest = SLOT(solabel);
 
-	mac_mls_copy(source, dest);
+	mls_copy(source, dest);
 }
 
 static void
-mac_mls_relabel_pipe(struct ucred *cred, struct pipepair *pp,
+mls_relabel_pipe(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, struct label *newlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1033,11 +1021,11 @@ mac_mls_relabel_pipe(struct ucred *cred, struct pipepair *pp,
 	source = SLOT(newlabel);
 	dest = SLOT(pplabel);
 
-	mac_mls_copy(source, dest);
+	mls_copy(source, dest);
 }
 
 static void
-mac_mls_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
+mls_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
     struct socket *so, struct label *sopeerlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1045,14 +1033,14 @@ mac_mls_set_socket_peer_from_mbuf(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(sopeerlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 /*
  * Labeling event operations: System V IPC objects.
  */
 static void
-mac_mls_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
+mls_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
 {
 	struct mac_mls *source, *dest;
@@ -1061,11 +1049,11 @@ mac_mls_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(msglabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr,
+mls_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1073,11 +1061,11 @@ mac_mls_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(msqlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
+mls_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semalabel)
 {
 	struct mac_mls *source, *dest;
@@ -1085,11 +1073,11 @@ mac_mls_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(semalabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
+mls_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1097,14 +1085,14 @@ mac_mls_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
 	source = SLOT(cred->cr_label);
 	dest = SLOT(shmlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 /*
  * Labeling event operations: network objects.
  */
 static void
-mac_mls_set_socket_peer_from_socket(struct socket *oldso,
+mls_set_socket_peer_from_socket(struct socket *oldso,
     struct label *oldsolabel, struct socket *newso,
     struct label *newsopeerlabel)
 {
@@ -1113,23 +1101,22 @@ mac_mls_set_socket_peer_from_socket(struct socket *oldso,
 	source = SLOT(oldsolabel);
 	dest = SLOT(newsopeerlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_bpfdesc(struct ucred *cred, struct bpf_d *d,
-    struct label *dlabel)
+mls_create_bpfdesc(struct ucred *cred, struct bpf_d *d, struct label *dlabel)
 {
 	struct mac_mls *source, *dest;
 
 	source = SLOT(cred->cr_label);
 	dest = SLOT(dlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
+mls_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
 {
 	struct mac_mls *dest;
 	int type;
@@ -1141,12 +1128,12 @@ mac_mls_create_ifnet(struct ifnet *ifp, struct label *ifplabel)
 	else
 		type = MAC_MLS_TYPE_LOW;
 
-	mac_mls_set_effective(dest, type, 0, NULL);
-	mac_mls_set_range(dest, type, 0, NULL, type, 0, NULL);
+	mls_set_effective(dest, type, 0, NULL);
+	mls_set_range(dest, type, 0, NULL, type, 0, NULL);
 }
 
 static void
-mac_mls_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
+mls_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
     struct label *ipqlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1154,11 +1141,11 @@ mac_mls_create_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
 	source = SLOT(mlabel);
 	dest = SLOT(ipqlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
+mls_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1167,11 +1154,11 @@ mac_mls_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
 	dest = SLOT(mlabel);
 
 	/* Just use the head, since we require them all to match. */
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_fragment(struct mbuf *m, struct label *mlabel,
+mls_create_fragment(struct mbuf *m, struct label *mlabel,
     struct mbuf *frag, struct label *fraglabel)
 {
 	struct mac_mls *source, *dest;
@@ -1179,11 +1166,11 @@ mac_mls_create_fragment(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(fraglabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
+mls_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1191,22 +1178,22 @@ mac_mls_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
 	source = SLOT(inplabel);
 	dest = SLOT(mlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
+mls_create_mbuf_linklayer(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *dest;
 
 	dest = SLOT(mlabel);
 
-	mac_mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
+	mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
 }
 
 static void
-mac_mls_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
+mls_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1214,11 +1201,11 @@ mac_mls_create_mbuf_from_bpfdesc(struct bpf_d *d, struct label *dlabel,
 	source = SLOT(dlabel);
 	dest = SLOT(mlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
+mls_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1226,11 +1213,11 @@ mac_mls_create_mbuf_from_ifnet(struct ifnet *ifp, struct label *ifplabel,
 	source = SLOT(ifplabel);
 	dest = SLOT(mlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
+mls_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
     struct ifnet *ifp, struct label *ifplabel, struct mbuf *mnew,
     struct label *mnewlabel)
 {
@@ -1239,11 +1226,11 @@ mac_mls_create_mbuf_multicast_encap(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(mnewlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
+mls_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
     struct mbuf *mnew, struct label *mnewlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1251,11 +1238,11 @@ mac_mls_create_mbuf_netlayer(struct mbuf *m, struct label *mlabel,
 	source = SLOT(mlabel);
 	dest = SLOT(mnewlabel);
 
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static int
-mac_mls_fragment_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
+mls_fragment_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
     struct label *ipqlabel)
 {
 	struct mac_mls *a, *b;
@@ -1263,11 +1250,11 @@ mac_mls_fragment_match(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
 	a = SLOT(ipqlabel);
 	b = SLOT(mlabel);
 
-	return (mac_mls_equal_effective(a, b));
+	return (mls_equal_effective(a, b));
 }
 
 static void
-mac_mls_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
+mls_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
     struct label *ifplabel, struct label *newlabel)
 {
 	struct mac_mls *source, *dest;
@@ -1275,11 +1262,11 @@ mac_mls_relabel_ifnet(struct ucred *cred, struct ifnet *ifp,
 	source = SLOT(newlabel);
 	dest = SLOT(ifplabel);
 
-	mac_mls_copy(source, dest);
+	mls_copy(source, dest);
 }
 
 static void
-mac_mls_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
+mls_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
     struct label *ipqlabel)
 {
 
@@ -1287,7 +1274,7 @@ mac_mls_update_ipq(struct mbuf *m, struct label *mlabel, struct ipq *ipq,
 }
 
 static void
-mac_mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 	struct mac_mls *source, *dest;
@@ -1295,105 +1282,105 @@ mac_mls_inpcb_sosetlabel(struct socket *so, struct label *solabel,
 	source = SLOT(solabel);
 	dest = SLOT(inplabel);
 
-	mac_mls_copy(source, dest);
+	mls_copy(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_from_firewall(struct mbuf *m, struct label *mlabel)
+mls_create_mbuf_from_firewall(struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *dest;
 
 	dest = SLOT(mlabel);
 
 	/* XXX: where is the label for the firewall really comming from? */
-	mac_mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
+	mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
 }
 
 static void
-mac_mls_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
+mls_init_syncache_from_inpcb(struct label *label, struct inpcb *inp)
 {
 	struct mac_mls *source, *dest;
 
 	source = SLOT(inp->inp_label);
 	dest = SLOT(label);
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 static void
-mac_mls_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
+mls_create_mbuf_from_syncache(struct label *sc_label, struct mbuf *m,
     struct label *mlabel)
 {
 	struct mac_mls *source, *dest;
 
 	source = SLOT(sc_label);
 	dest = SLOT(mlabel);
-	mac_mls_copy_effective(source, dest);
+	mls_copy_effective(source, dest);
 }
 
 /*
  * Labeling event operations: processes.
  */
 static void
-mac_mls_create_proc0(struct ucred *cred)
+mls_create_proc0(struct ucred *cred)
 {
 	struct mac_mls *dest;
 
 	dest = SLOT(cred->cr_label);
 
-	mac_mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
-	mac_mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH,
-	    0, NULL);
+	mls_set_effective(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
+	mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
+	    NULL);
 }
 
 static void
-mac_mls_create_proc1(struct ucred *cred)
+mls_create_proc1(struct ucred *cred)
 {
 	struct mac_mls *dest;
 
 	dest = SLOT(cred->cr_label);
 
-	mac_mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL);
-	mac_mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH,
-	    0, NULL);
+	mls_set_effective(dest, MAC_MLS_TYPE_LOW, 0, NULL);
+	mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH, 0,
+	    NULL);
 }
 
 static void
-mac_mls_relabel_cred(struct ucred *cred, struct label *newlabel)
+mls_relabel_cred(struct ucred *cred, struct label *newlabel)
 {
 	struct mac_mls *source, *dest;
 
 	source = SLOT(newlabel);
 	dest = SLOT(cred->cr_label);
 
-	mac_mls_copy(source, dest);
+	mls_copy(source, dest);
 }
 
 /*
  * Label cleanup/flush operations.
  */
 static void
-mac_mls_cleanup_sysv_msgmsg(struct label *msglabel)
+mls_cleanup_sysv_msgmsg(struct label *msglabel)
 {
 
 	bzero(SLOT(msglabel), sizeof(struct mac_mls));
 }
 
 static void
-mac_mls_cleanup_sysv_msgqueue(struct label *msqlabel)
+mls_cleanup_sysv_msgqueue(struct label *msqlabel)
 {
 
 	bzero(SLOT(msqlabel), sizeof(struct mac_mls));
 }
 
 static void
-mac_mls_cleanup_sysv_sem(struct label *semalabel)
+mls_cleanup_sysv_sem(struct label *semalabel)
 {
 
 	bzero(SLOT(semalabel), sizeof(struct mac_mls));
 }
 
 static void
-mac_mls_cleanup_sysv_shm(struct label *shmlabel)
+mls_cleanup_sysv_shm(struct label *shmlabel)
 {
 
 	bzero(SLOT(shmlabel), sizeof(struct mac_mls));
@@ -1403,24 +1390,24 @@ mac_mls_cleanup_sysv_shm(struct label *shmlabel)
  * Access control checks.
  */
 static int
-mac_mls_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
+mls_check_bpfdesc_receive(struct bpf_d *d, struct label *dlabel,
      struct ifnet *ifp, struct label *ifplabel)
 {
 	struct mac_mls *a, *b;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	a = SLOT(dlabel);
 	b = SLOT(ifplabel);
 
-	if (mac_mls_equal_effective(a, b))
+	if (mls_equal_effective(a, b))
 		return (0);
 	return (EACCES);
 }
 
 static int
-mac_mls_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+mls_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 {
 	struct mac_mls *subj, *new;
 	int error;
@@ -1429,8 +1416,8 @@ mac_mls_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 	new = SLOT(newlabel);
 
 	/*
-	 * If there is an MLS label update for the credential, it may be
-	 * an update of effective, range, or both.
+	 * If there is an MLS label update for the credential, it may be an
+	 * update of effective, range, or both.
 	 */
 	error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
 	if (error)
@@ -1441,38 +1428,37 @@ mac_mls_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 	 */
 	if (new->mm_flags & MAC_MLS_FLAGS_BOTH) {
 		/*
-		 * If the change request modifies both the MLS label effective
-		 * and range, check that the new effective will be in the
-		 * new range.
+		 * If the change request modifies both the MLS label
+		 * effective and range, check that the new effective will be
+		 * in the new range.
 		 */
 		if ((new->mm_flags & MAC_MLS_FLAGS_BOTH) ==
 		    MAC_MLS_FLAGS_BOTH &&
-		    !mac_mls_effective_in_range(new, new))
+		    !mls_effective_in_range(new, new))
 			return (EINVAL);
 
 		/*
-		 * To change the MLS effective label on a credential, the
-		 * new effective label must be in the current range.
+		 * To change the MLS effective label on a credential, the new
+		 * effective label must be in the current range.
 		 */
 		if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE &&
-		    !mac_mls_effective_in_range(new, subj))
+		    !mls_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To change the MLS range label on a credential, the
-		 * new range must be in the current range.
+		 * To change the MLS range label on a credential, the new
+		 * range must be in the current range.
 		 */
 		if (new->mm_flags & MAC_MLS_FLAG_RANGE &&
-		    !mac_mls_range_in_range(new, subj))
+		    !mls_range_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To have EQUAL in any component of the new credential
-		 * MLS label, the subject must already have EQUAL in
-		 * their label.
+		 * To have EQUAL in any component of the new credential MLS
+		 * label, the subject must already have EQUAL in their label.
 		 */
-		if (mac_mls_contains_equal(new)) {
-			error = mac_mls_subject_privileged(subj);
+		if (mls_contains_equal(new)) {
+			error = mls_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1482,25 +1468,25 @@ mac_mls_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 }
 
 static int
-mac_mls_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
+mls_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cr1->cr_label);
 	obj = SLOT(cr2->cr_label);
 
 	/* XXX: range */
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (ESRCH);
 
 	return (0);
 }
 
 static int
-mac_mls_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
+mls_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
     struct label *ifplabel, struct label *newlabel)
 {
 	struct mac_mls *subj, *new;
@@ -1510,8 +1496,8 @@ mac_mls_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 	new = SLOT(newlabel);
 
 	/*
-	 * If there is an MLS label update for the interface, it may
-	 * be an update of effective, range, or both.
+	 * If there is an MLS label update for the interface, it may be an
+	 * update of effective, range, or both.
 	 */
 	error = mls_atmostflags(new, MAC_MLS_FLAGS_BOTH);
 	if (error)
@@ -1520,136 +1506,136 @@ mac_mls_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifp,
 	/*
 	 * Relabeling network interfaces requires MLS privilege.
 	 */
-	return (mac_mls_subject_privileged(subj));
+	return (mls_subject_privileged(subj));
 }
 
 static int
-mac_mls_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
+mls_check_ifnet_transmit(struct ifnet *ifp, struct label *ifplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *p, *i;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	i = SLOT(ifplabel);
 
-	return (mac_mls_effective_in_range(p, i) ? 0 : EACCES);
+	return (mls_effective_in_range(p, i) ? 0 : EACCES);
 }
 
 static int
-mac_mls_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+mls_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *p, *i;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	i = SLOT(inplabel);
 
-	return (mac_mls_equal_effective(p, i) ? 0 : EACCES);
+	return (mls_equal_effective(p, i) ? 0 : EACCES);
 }
 
 static int
-mac_mls_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
+mls_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
     struct label *msglabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msglabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
+mls_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
     struct label *msglabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msglabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
+mls_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msqklabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
+mls_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msqklabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
+mls_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(msqklabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
+mls_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel, int cmd)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -1658,12 +1644,12 @@ mac_mls_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
 	switch(cmd) {
 	case IPC_RMID:
 	case IPC_SET:
-		if (!mac_mls_dominate_effective(obj, subj))
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 		break;
 
 	case IPC_STAT:
-		if (!mac_mls_dominate_effective(subj, obj))
+		if (!mls_dominate_effective(subj, obj))
 			return (EACCES);
 		break;
 
@@ -1675,12 +1661,12 @@ mac_mls_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
 }
 
 static int
-mac_mls_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
+mls_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel, int cmd)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -1691,7 +1677,7 @@ mac_mls_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 	case IPC_SET:
 	case SETVAL:
 	case SETALL:
-		if (!mac_mls_dominate_effective(obj, subj))
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 		break;
 
@@ -1701,7 +1687,7 @@ mac_mls_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 	case GETNCNT:
 	case GETZCNT:
 	case GETALL:
-		if (!mac_mls_dominate_effective(subj, obj))
+		if (!mls_dominate_effective(subj, obj))
 			return (EACCES);
 		break;
 
@@ -1713,74 +1699,74 @@ mac_mls_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 }
 
 static int
-mac_mls_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
+mls_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(semaklabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
+mls_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel, size_t accesstype)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(semaklabel);
 
-	if( accesstype & SEM_R )
-		if (!mac_mls_dominate_effective(subj, obj))
+	if (accesstype & SEM_R)
+		if (!mls_dominate_effective(subj, obj))
 			return (EACCES);
 
-	if( accesstype & SEM_A )
-		if (!mac_mls_dominate_effective(obj, subj))
+	if (accesstype & SEM_A)
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
+mls_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int shmflg)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(shmseglabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
-			return (EACCES);
+	if (!mls_dominate_effective(subj, obj))
+		return (EACCES);
 	if ((shmflg & SHM_RDONLY) == 0)
-		if (!mac_mls_dominate_effective(obj, subj))
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 	
 	return (0);
 }
 
 static int
-mac_mls_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
+mls_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int cmd)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -1789,13 +1775,13 @@ mac_mls_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
 	switch(cmd) {
 	case IPC_RMID:
 	case IPC_SET:
-		if (!mac_mls_dominate_effective(obj, subj))
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 		break;
 
 	case IPC_STAT:
 	case SHM_STAT:
-		if (!mac_mls_dominate_effective(subj, obj))
+		if (!mls_dominate_effective(subj, obj))
 			return (EACCES);
 		break;
 
@@ -1807,47 +1793,47 @@ mac_mls_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
 }
 
 static int
-mac_mls_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
+mls_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int shmflg)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(shmseglabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_mount_stat(struct ucred *cred, struct mount *mp,
+mls_check_mount_stat(struct ucred *cred, struct mount *mp,
     struct label *mntlabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(mntlabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
+mls_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, unsigned long cmd, void /* caddr_t */ *data)
 {
 
-	if(!mac_mls_enabled)
+	if(!mls_enabled)
 		return (0);
 
 	/* XXX: This will be implemented soon... */
@@ -1856,43 +1842,43 @@ mac_mls_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
 }
 
 static int
-mac_mls_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
+mls_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_pipe_read(struct ucred *cred, struct pipepair *pp,
+mls_check_pipe_read(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
+mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel, struct label *newlabel)
 {
 	struct mac_mls *subj, *obj, *new;
@@ -1903,8 +1889,8 @@ mac_mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	obj = SLOT(pplabel);
 
 	/*
-	 * If there is an MLS label update for a pipe, it must be a
-	 * effective update.
+	 * If there is an MLS label update for a pipe, it must be a effective
+	 * update.
 	 */
 	error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
 	if (error)
@@ -1914,7 +1900,7 @@ mac_mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	 * To perform a relabel of a pipe (MLS label or not), MLS must
 	 * authorize the relabel.
 	 */
-	if (!mac_mls_effective_in_range(obj, subj))
+	if (!mls_effective_in_range(obj, subj))
 		return (EPERM);
 
 	/*
@@ -1922,18 +1908,18 @@ mac_mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 	 */
 	if (new->mm_flags & MAC_MLS_FLAG_EFFECTIVE) {
 		/*
-		 * To change the MLS label on a pipe, the new pipe label
-		 * must be in the subject range.
+		 * To change the MLS label on a pipe, the new pipe label must
+		 * be in the subject range.
 		 */
-		if (!mac_mls_effective_in_range(new, subj))
+		if (!mls_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To change the MLS label on a pipe to be EQUAL, the
-		 * subject must have appropriate privilege.
+		 * To change the MLS label on a pipe to be EQUAL, the subject
+		 * must have appropriate privilege.
 		 */
-		if (mac_mls_contains_equal(new)) {
-			error = mac_mls_subject_privileged(subj);
+		if (mls_contains_equal(new)) {
+			error = mls_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -1943,154 +1929,154 @@ mac_mls_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 }
 
 static int
-mac_mls_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
+mls_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_pipe_write(struct ucred *cred, struct pipepair *pp,
+mls_check_pipe_write(struct ucred *cred, struct pipepair *pp,
     struct label *pplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(pplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_posix_sem_write(struct ucred *cred, struct ksem *ks,
+mls_check_posix_sem_write(struct ucred *cred, struct ksem *ks,
     struct label *kslabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(kslabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_posix_sem_rdonly(struct ucred *cred, struct ksem *ks,
+mls_check_posix_sem_rdonly(struct ucred *cred, struct ksem *ks,
     struct label *kslabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(kslabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_proc_debug(struct ucred *cred, struct proc *p)
+mls_check_proc_debug(struct ucred *cred, struct proc *p)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (ESRCH);
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_proc_sched(struct ucred *cred, struct proc *p)
+mls_check_proc_sched(struct ucred *cred, struct proc *p)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (ESRCH);
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
+mls_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(p->p_ucred->cr_label);
 
 	/* XXX: range checks */
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (ESRCH);
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_socket_deliver(struct socket *so, struct label *solabel,
+mls_check_socket_deliver(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 	struct mac_mls *p, *s;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	p = SLOT(mlabel);
 	s = SLOT(solabel);
 
-	return (mac_mls_equal_effective(p, s) ? 0 : EACCES);
+	return (mls_equal_effective(p, s) ? 0 : EACCES);
 }
 
 static int
-mac_mls_check_socket_relabel(struct ucred *cred, struct socket *so,
+mls_check_socket_relabel(struct ucred *cred, struct socket *so,
     struct label *solabel, struct label *newlabel)
 {
 	struct mac_mls *subj, *obj, *new;
@@ -2101,18 +2087,18 @@ mac_mls_check_socket_relabel(struct ucred *cred, struct socket *so,
 	obj = SLOT(solabel);
 
 	/*
-	 * If there is an MLS label update for the socket, it may be
-	 * an update of effective.
+	 * If there is an MLS label update for the socket, it may be an
+	 * update of effective.
 	 */
 	error = mls_atmostflags(new, MAC_MLS_FLAG_EFFECTIVE);
 	if (error)
 		return (error);
 
 	/*
-	 * To relabel a socket, the old socket effective must be in the subject
-	 * range.
+	 * To relabel a socket, the old socket effective must be in the
+	 * subject range.
 	 */
-	if (!mac_mls_effective_in_range(obj, subj))
+	if (!mls_effective_in_range(obj, subj))
 		return (EPERM);
 
 	/*
@@ -2123,15 +2109,15 @@ mac_mls_check_socket_relabel(struct ucred *cred, struct socket *so,
 		 * To relabel a socket, the new socket effective must be in
 		 * the subject range.
 		 */
-		if (!mac_mls_effective_in_range(new, subj))
+		if (!mls_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
 		 * To change the MLS label on the socket to contain EQUAL,
 		 * the subject must have appropriate privilege.
 		 */
-		if (mac_mls_contains_equal(new)) {
-			error = mac_mls_subject_privileged(subj);
+		if (mls_contains_equal(new)) {
+			error = mls_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2141,172 +2127,172 @@ mac_mls_check_socket_relabel(struct ucred *cred, struct socket *so,
 }
 
 static int
-mac_mls_check_socket_visible(struct ucred *cred, struct socket *so,
+mls_check_socket_visible(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(solabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (ENOENT);
 
 	return (0);
 }
 
 static int
-mac_mls_check_system_acct(struct ucred *cred, struct vnode *vp,
+mls_check_system_acct(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj) ||
-	    !mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(obj, subj) ||
+	    !mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_system_auditctl(struct ucred *cred, struct vnode *vp,
+mls_check_system_auditctl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj) ||
-	    !mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(obj, subj) ||
+	    !mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_system_swapon(struct ucred *cred, struct vnode *vp,
+mls_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj) ||
-	    !mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(obj, subj) ||
+	    !mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_create(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_exec(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_exec(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct image_params *imgp,
     struct label *execlabel)
 {
@@ -2316,8 +2302,8 @@ mac_mls_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 	if (execlabel != NULL) {
 		/*
 		 * We currently don't permit labels to be changed at
-		 * exec-time as part of MLS, so disallow non-NULL
-		 * MLS label elements in the execlabel.
+		 * exec-time as part of MLS, so disallow non-NULL MLS label
+		 * elements in the execlabel.
 		 */
 		exec = SLOT(execlabel);
 		error = mls_atmostflags(exec, 0);
@@ -2325,117 +2311,117 @@ mac_mls_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 			return (error);
 	}
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_link(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_link(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace)
 {
 
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int prot, int flags)
 {
 	struct mac_mls *subj, *obj;
@@ -2444,18 +2430,18 @@ mac_mls_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 	 * Rely on the use of open()-time protections to handle
 	 * non-revocation cases.
 	 */
-	if (!mac_mls_enabled || !revocation_enabled)
+	if (!mls_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
 	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
-		if (!mac_mls_dominate_effective(subj, obj))
+		if (!mls_dominate_effective(subj, obj))
 			return (EACCES);
 	}
 	if (((prot & VM_PROT_WRITE) != 0) && ((flags & MAP_SHARED) != 0)) {
-		if (!mac_mls_dominate_effective(obj, subj))
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 	}
 
@@ -2463,12 +2449,12 @@ mac_mls_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_mls_check_vnode_open(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_open(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int acc_mode)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
@@ -2476,11 +2462,11 @@ mac_mls_check_vnode_open(struct ucred *cred, struct vnode *vp,
 
 	/* XXX privilege override for admin? */
 	if (acc_mode & (VREAD | VEXEC | VSTAT)) {
-		if (!mac_mls_dominate_effective(subj, obj))
+		if (!mls_dominate_effective(subj, obj))
 			return (EACCES);
 	}
 	if (acc_mode & (VWRITE | VAPPEND | VADMIN)) {
-		if (!mac_mls_dominate_effective(obj, subj))
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 	}
 
@@ -2488,79 +2474,79 @@ mac_mls_check_vnode_open(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_mls_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+mls_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled || !revocation_enabled)
+	if (!mls_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+mls_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled || !revocation_enabled)
+	if (!mls_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *newlabel)
 {
 	struct mac_mls *old, *new, *subj;
@@ -2582,7 +2568,7 @@ mac_mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 	 * To perform a relabel of the vnode (MLS label or not), MLS must
 	 * authorize the relabel.
 	 */
-	if (!mac_mls_effective_in_range(old, subj))
+	if (!mls_effective_in_range(old, subj))
 		return (EPERM);
 
 	/*
@@ -2593,15 +2579,15 @@ mac_mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 		 * To change the MLS label on a vnode, the new vnode label
 		 * must be in the subject range.
 		 */
-		if (!mac_mls_effective_in_range(new, subj))
+		if (!mls_effective_in_range(new, subj))
 			return (EPERM);
 
 		/*
-		 * To change the MLS label on the vnode to be EQUAL,
-		 * the subject must have appropriate privilege.
+		 * To change the MLS label on the vnode to be EQUAL, the
+		 * subject must have appropriate privilege.
 		 */
-		if (mac_mls_contains_equal(new)) {
-			error = mac_mls_subject_privileged(subj);
+		if (mls_contains_equal(new)) {
+			error = mls_subject_privileged(subj);
 			if (error)
 				return (error);
 		}
@@ -2611,49 +2597,49 @@ mac_mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_mls_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     int samedir, struct componentname *cnp)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	if (vp != NULL) {
 		obj = SLOT(vplabel);
 
-		if (!mac_mls_dominate_effective(obj, subj))
+		if (!mls_dominate_effective(obj, subj))
 			return (EACCES);
 	}
 
@@ -2661,55 +2647,55 @@ mac_mls_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 }
 
 static int
-mac_mls_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type, struct acl *acl)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	/* XXX: protect the MAC EA in a special way? */
@@ -2718,327 +2704,327 @@ mac_mls_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 }
 
 static int
-mac_mls_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, u_long flags)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, mode_t mode)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, uid_t uid, gid_t gid)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+mls_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct timespec atime, struct timespec mtime)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+mls_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(subj, obj))
+	if (!mls_dominate_effective(subj, obj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
+mls_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled)
+	if (!mls_enabled)
 		return (0);
 
 	subj = SLOT(cred->cr_label);
 	obj = SLOT(dvplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static int
-mac_mls_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
+mls_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 	struct mac_mls *subj, *obj;
 
-	if (!mac_mls_enabled || !revocation_enabled)
+	if (!mls_enabled || !revocation_enabled)
 		return (0);
 
 	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vplabel);
 
-	if (!mac_mls_dominate_effective(obj, subj))
+	if (!mls_dominate_effective(obj, subj))
 		return (EACCES);
 
 	return (0);
 }
 
 static void
-mac_mls_associate_nfsd_label(struct ucred *cred) 
+mls_associate_nfsd_label(struct ucred *cred) 
 {
 	struct mac_mls *label;
 
 	label = SLOT(cred->cr_label);
-	mac_mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL);
-	mac_mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL,
+	mls_set_effective(label, MAC_MLS_TYPE_LOW, 0, NULL);
+	mls_set_range(label, MAC_MLS_TYPE_LOW, 0, NULL,
 	    MAC_MLS_TYPE_HIGH, 0, NULL);
 }
 
-static struct mac_policy_ops mac_mls_ops =
-{
-	.mpo_init = mac_mls_init,
-	.mpo_init_bpfdesc_label = mac_mls_init_label,
-	.mpo_init_cred_label = mac_mls_init_label,
-	.mpo_init_devfs_label = mac_mls_init_label,
-	.mpo_init_ifnet_label = mac_mls_init_label,
-	.mpo_init_inpcb_label = mac_mls_init_label_waitcheck,
-	.mpo_init_syncache_label = mac_mls_init_label_waitcheck,
-	.mpo_init_sysv_msgmsg_label = mac_mls_init_label,
-	.mpo_init_sysv_msgqueue_label = mac_mls_init_label,
-	.mpo_init_sysv_sem_label = mac_mls_init_label,
-	.mpo_init_sysv_shm_label = mac_mls_init_label,
-	.mpo_init_ipq_label = mac_mls_init_label_waitcheck,
-	.mpo_init_mbuf_label = mac_mls_init_label_waitcheck,
-	.mpo_init_mount_label = mac_mls_init_label,
-	.mpo_init_pipe_label = mac_mls_init_label,
-	.mpo_init_posix_sem_label = mac_mls_init_label,
-	.mpo_init_socket_label = mac_mls_init_label_waitcheck,
-	.mpo_init_socket_peer_label = mac_mls_init_label_waitcheck,
-	.mpo_init_vnode_label = mac_mls_init_label,
-	.mpo_destroy_bpfdesc_label = mac_mls_destroy_label,
-	.mpo_destroy_cred_label = mac_mls_destroy_label,
-	.mpo_destroy_devfs_label = mac_mls_destroy_label,
-	.mpo_destroy_ifnet_label = mac_mls_destroy_label,
-	.mpo_destroy_inpcb_label = mac_mls_destroy_label,
-	.mpo_destroy_syncache_label = mac_mls_destroy_label,
-	.mpo_destroy_sysv_msgmsg_label = mac_mls_destroy_label,
-	.mpo_destroy_sysv_msgqueue_label = mac_mls_destroy_label,
-	.mpo_destroy_sysv_sem_label = mac_mls_destroy_label,
-	.mpo_destroy_sysv_shm_label = mac_mls_destroy_label,
-	.mpo_destroy_ipq_label = mac_mls_destroy_label,
-	.mpo_destroy_mbuf_label = mac_mls_destroy_label,
-	.mpo_destroy_mount_label = mac_mls_destroy_label,
-	.mpo_destroy_pipe_label = mac_mls_destroy_label,
-	.mpo_destroy_posix_sem_label = mac_mls_destroy_label,
-	.mpo_destroy_socket_label = mac_mls_destroy_label,
-	.mpo_destroy_socket_peer_label = mac_mls_destroy_label,
-	.mpo_destroy_vnode_label = mac_mls_destroy_label,
-	.mpo_copy_cred_label = mac_mls_copy_label,
-	.mpo_copy_ifnet_label = mac_mls_copy_label,
-	.mpo_copy_mbuf_label = mac_mls_copy_label,
-	.mpo_copy_pipe_label = mac_mls_copy_label,
-	.mpo_copy_socket_label = mac_mls_copy_label,
-	.mpo_copy_vnode_label = mac_mls_copy_label,
-	.mpo_externalize_cred_label = mac_mls_externalize_label,
-	.mpo_externalize_ifnet_label = mac_mls_externalize_label,
-	.mpo_externalize_pipe_label = mac_mls_externalize_label,
-	.mpo_externalize_socket_label = mac_mls_externalize_label,
-	.mpo_externalize_socket_peer_label = mac_mls_externalize_label,
-	.mpo_externalize_vnode_label = mac_mls_externalize_label,
-	.mpo_internalize_cred_label = mac_mls_internalize_label,
-	.mpo_internalize_ifnet_label = mac_mls_internalize_label,
-	.mpo_internalize_pipe_label = mac_mls_internalize_label,
-	.mpo_internalize_socket_label = mac_mls_internalize_label,
-	.mpo_internalize_vnode_label = mac_mls_internalize_label,
-	.mpo_create_devfs_device = mac_mls_create_devfs_device,
-	.mpo_create_devfs_directory = mac_mls_create_devfs_directory,
-	.mpo_create_devfs_symlink = mac_mls_create_devfs_symlink,
-	.mpo_create_mount = mac_mls_create_mount,
-	.mpo_relabel_vnode = mac_mls_relabel_vnode,
-	.mpo_update_devfs = mac_mls_update_devfs,
-	.mpo_associate_vnode_devfs = mac_mls_associate_vnode_devfs,
-	.mpo_associate_vnode_extattr = mac_mls_associate_vnode_extattr,
-	.mpo_associate_vnode_singlelabel = mac_mls_associate_vnode_singlelabel,
-	.mpo_create_vnode_extattr = mac_mls_create_vnode_extattr,
-	.mpo_setlabel_vnode_extattr = mac_mls_setlabel_vnode_extattr,
-	.mpo_create_mbuf_from_socket = mac_mls_create_mbuf_from_socket,
-	.mpo_create_mbuf_from_syncache = mac_mls_create_mbuf_from_syncache,
-	.mpo_create_pipe = mac_mls_create_pipe,
-	.mpo_create_posix_sem = mac_mls_create_posix_sem,
-	.mpo_create_socket = mac_mls_create_socket,
-	.mpo_create_socket_from_socket = mac_mls_create_socket_from_socket,
-	.mpo_relabel_pipe = mac_mls_relabel_pipe,
-	.mpo_relabel_socket = mac_mls_relabel_socket,
-	.mpo_set_socket_peer_from_mbuf = mac_mls_set_socket_peer_from_mbuf,
-	.mpo_set_socket_peer_from_socket = mac_mls_set_socket_peer_from_socket,
-	.mpo_create_bpfdesc = mac_mls_create_bpfdesc,
-	.mpo_create_datagram_from_ipq = mac_mls_create_datagram_from_ipq,
-	.mpo_create_fragment = mac_mls_create_fragment,
-	.mpo_create_ifnet = mac_mls_create_ifnet,
-	.mpo_create_inpcb_from_socket = mac_mls_create_inpcb_from_socket,
-	.mpo_init_syncache_from_inpcb = mac_mls_init_syncache_from_inpcb,
-	.mpo_create_ipq = mac_mls_create_ipq,
-	.mpo_create_sysv_msgmsg = mac_mls_create_sysv_msgmsg,
-	.mpo_create_sysv_msgqueue = mac_mls_create_sysv_msgqueue,
-	.mpo_create_sysv_sem = mac_mls_create_sysv_sem,
-	.mpo_create_sysv_shm = mac_mls_create_sysv_shm,
-	.mpo_create_mbuf_from_inpcb = mac_mls_create_mbuf_from_inpcb,
-	.mpo_create_mbuf_linklayer = mac_mls_create_mbuf_linklayer,
-	.mpo_create_mbuf_from_bpfdesc = mac_mls_create_mbuf_from_bpfdesc,
-	.mpo_create_mbuf_from_ifnet = mac_mls_create_mbuf_from_ifnet,
-	.mpo_create_mbuf_multicast_encap = mac_mls_create_mbuf_multicast_encap,
-	.mpo_create_mbuf_netlayer = mac_mls_create_mbuf_netlayer,
-	.mpo_fragment_match = mac_mls_fragment_match,
-	.mpo_relabel_ifnet = mac_mls_relabel_ifnet,
-	.mpo_update_ipq = mac_mls_update_ipq,
-	.mpo_inpcb_sosetlabel = mac_mls_inpcb_sosetlabel,
-	.mpo_create_proc0 = mac_mls_create_proc0,
-	.mpo_create_proc1 = mac_mls_create_proc1,
-	.mpo_relabel_cred = mac_mls_relabel_cred,
-	.mpo_cleanup_sysv_msgmsg = mac_mls_cleanup_sysv_msgmsg,
-	.mpo_cleanup_sysv_msgqueue = mac_mls_cleanup_sysv_msgqueue,
-	.mpo_cleanup_sysv_sem = mac_mls_cleanup_sysv_sem,
-	.mpo_cleanup_sysv_shm = mac_mls_cleanup_sysv_shm,
-	.mpo_check_bpfdesc_receive = mac_mls_check_bpfdesc_receive,
-	.mpo_check_cred_relabel = mac_mls_check_cred_relabel,
-	.mpo_check_cred_visible = mac_mls_check_cred_visible,
-	.mpo_check_ifnet_relabel = mac_mls_check_ifnet_relabel,
-	.mpo_check_ifnet_transmit = mac_mls_check_ifnet_transmit,
-	.mpo_check_inpcb_deliver = mac_mls_check_inpcb_deliver,
-	.mpo_check_sysv_msgrcv = mac_mls_check_sysv_msgrcv,
-	.mpo_check_sysv_msgrmid = mac_mls_check_sysv_msgrmid,
-	.mpo_check_sysv_msqget = mac_mls_check_sysv_msqget,
-	.mpo_check_sysv_msqsnd = mac_mls_check_sysv_msqsnd,
-	.mpo_check_sysv_msqrcv = mac_mls_check_sysv_msqrcv,
-	.mpo_check_sysv_msqctl = mac_mls_check_sysv_msqctl,
-	.mpo_check_sysv_semctl = mac_mls_check_sysv_semctl,
-	.mpo_check_sysv_semget = mac_mls_check_sysv_semget,
-	.mpo_check_sysv_semop = mac_mls_check_sysv_semop,
-	.mpo_check_sysv_shmat = mac_mls_check_sysv_shmat,
-	.mpo_check_sysv_shmctl = mac_mls_check_sysv_shmctl,
-	.mpo_check_sysv_shmget = mac_mls_check_sysv_shmget,
-	.mpo_check_mount_stat = mac_mls_check_mount_stat,
-	.mpo_check_pipe_ioctl = mac_mls_check_pipe_ioctl,
-	.mpo_check_pipe_poll = mac_mls_check_pipe_poll,
-	.mpo_check_pipe_read = mac_mls_check_pipe_read,
-	.mpo_check_pipe_relabel = mac_mls_check_pipe_relabel,
-	.mpo_check_pipe_stat = mac_mls_check_pipe_stat,
-	.mpo_check_pipe_write = mac_mls_check_pipe_write,
-	.mpo_check_posix_sem_destroy = mac_mls_check_posix_sem_write,
-	.mpo_check_posix_sem_getvalue = mac_mls_check_posix_sem_rdonly,
-	.mpo_check_posix_sem_open = mac_mls_check_posix_sem_write,
-	.mpo_check_posix_sem_post = mac_mls_check_posix_sem_write,
-	.mpo_check_posix_sem_unlink = mac_mls_check_posix_sem_write,
-	.mpo_check_posix_sem_wait = mac_mls_check_posix_sem_write,
-	.mpo_check_proc_debug = mac_mls_check_proc_debug,
-	.mpo_check_proc_sched = mac_mls_check_proc_sched,
-	.mpo_check_proc_signal = mac_mls_check_proc_signal,
-	.mpo_check_socket_deliver = mac_mls_check_socket_deliver,
-	.mpo_check_socket_relabel = mac_mls_check_socket_relabel,
-	.mpo_check_socket_visible = mac_mls_check_socket_visible,
-	.mpo_check_system_acct = mac_mls_check_system_acct,
-	.mpo_check_system_auditctl = mac_mls_check_system_auditctl,
-	.mpo_check_system_swapon = mac_mls_check_system_swapon,
-	.mpo_check_vnode_access = mac_mls_check_vnode_open,
-	.mpo_check_vnode_chdir = mac_mls_check_vnode_chdir,
-	.mpo_check_vnode_chroot = mac_mls_check_vnode_chroot,
-	.mpo_check_vnode_create = mac_mls_check_vnode_create,
-	.mpo_check_vnode_deleteacl = mac_mls_check_vnode_deleteacl,
-	.mpo_check_vnode_deleteextattr = mac_mls_check_vnode_deleteextattr,
-	.mpo_check_vnode_exec = mac_mls_check_vnode_exec,
-	.mpo_check_vnode_getacl = mac_mls_check_vnode_getacl,
-	.mpo_check_vnode_getextattr = mac_mls_check_vnode_getextattr,
-	.mpo_check_vnode_link = mac_mls_check_vnode_link,
-	.mpo_check_vnode_listextattr = mac_mls_check_vnode_listextattr,
-	.mpo_check_vnode_lookup = mac_mls_check_vnode_lookup,
-	.mpo_check_vnode_mmap = mac_mls_check_vnode_mmap,
-	.mpo_check_vnode_open = mac_mls_check_vnode_open,
-	.mpo_check_vnode_poll = mac_mls_check_vnode_poll,
-	.mpo_check_vnode_read = mac_mls_check_vnode_read,
-	.mpo_check_vnode_readdir = mac_mls_check_vnode_readdir,
-	.mpo_check_vnode_readlink = mac_mls_check_vnode_readlink,
-	.mpo_check_vnode_relabel = mac_mls_check_vnode_relabel,
-	.mpo_check_vnode_rename_from = mac_mls_check_vnode_rename_from,
-	.mpo_check_vnode_rename_to = mac_mls_check_vnode_rename_to,
-	.mpo_check_vnode_revoke = mac_mls_check_vnode_revoke,
-	.mpo_check_vnode_setacl = mac_mls_check_vnode_setacl,
-	.mpo_check_vnode_setextattr = mac_mls_check_vnode_setextattr,
-	.mpo_check_vnode_setflags = mac_mls_check_vnode_setflags,
-	.mpo_check_vnode_setmode = mac_mls_check_vnode_setmode,
-	.mpo_check_vnode_setowner = mac_mls_check_vnode_setowner,
-	.mpo_check_vnode_setutimes = mac_mls_check_vnode_setutimes,
-	.mpo_check_vnode_stat = mac_mls_check_vnode_stat,
-	.mpo_check_vnode_unlink = mac_mls_check_vnode_unlink,
-	.mpo_check_vnode_write = mac_mls_check_vnode_write,
-	.mpo_associate_nfsd_label = mac_mls_associate_nfsd_label,
-	.mpo_create_mbuf_from_firewall = mac_mls_create_mbuf_from_firewall,
+static struct mac_policy_ops mls_ops =
+{
+	.mpo_init = mls_init,
+	.mpo_init_bpfdesc_label = mls_init_label,
+	.mpo_init_cred_label = mls_init_label,
+	.mpo_init_devfs_label = mls_init_label,
+	.mpo_init_ifnet_label = mls_init_label,
+	.mpo_init_inpcb_label = mls_init_label_waitcheck,
+	.mpo_init_syncache_label = mls_init_label_waitcheck,
+	.mpo_init_sysv_msgmsg_label = mls_init_label,
+	.mpo_init_sysv_msgqueue_label = mls_init_label,
+	.mpo_init_sysv_sem_label = mls_init_label,
+	.mpo_init_sysv_shm_label = mls_init_label,
+	.mpo_init_ipq_label = mls_init_label_waitcheck,
+	.mpo_init_mbuf_label = mls_init_label_waitcheck,
+	.mpo_init_mount_label = mls_init_label,
+	.mpo_init_pipe_label = mls_init_label,
+	.mpo_init_posix_sem_label = mls_init_label,
+	.mpo_init_socket_label = mls_init_label_waitcheck,
+	.mpo_init_socket_peer_label = mls_init_label_waitcheck,
+	.mpo_init_vnode_label = mls_init_label,
+	.mpo_destroy_bpfdesc_label = mls_destroy_label,
+	.mpo_destroy_cred_label = mls_destroy_label,
+	.mpo_destroy_devfs_label = mls_destroy_label,
+	.mpo_destroy_ifnet_label = mls_destroy_label,
+	.mpo_destroy_inpcb_label = mls_destroy_label,
+	.mpo_destroy_syncache_label = mls_destroy_label,
+	.mpo_destroy_sysv_msgmsg_label = mls_destroy_label,
+	.mpo_destroy_sysv_msgqueue_label = mls_destroy_label,
+	.mpo_destroy_sysv_sem_label = mls_destroy_label,
+	.mpo_destroy_sysv_shm_label = mls_destroy_label,
+	.mpo_destroy_ipq_label = mls_destroy_label,
+	.mpo_destroy_mbuf_label = mls_destroy_label,
+	.mpo_destroy_mount_label = mls_destroy_label,
+	.mpo_destroy_pipe_label = mls_destroy_label,
+	.mpo_destroy_posix_sem_label = mls_destroy_label,
+	.mpo_destroy_socket_label = mls_destroy_label,
+	.mpo_destroy_socket_peer_label = mls_destroy_label,
+	.mpo_destroy_vnode_label = mls_destroy_label,
+	.mpo_copy_cred_label = mls_copy_label,
+	.mpo_copy_ifnet_label = mls_copy_label,
+	.mpo_copy_mbuf_label = mls_copy_label,
+	.mpo_copy_pipe_label = mls_copy_label,
+	.mpo_copy_socket_label = mls_copy_label,
+	.mpo_copy_vnode_label = mls_copy_label,
+	.mpo_externalize_cred_label = mls_externalize_label,
+	.mpo_externalize_ifnet_label = mls_externalize_label,
+	.mpo_externalize_pipe_label = mls_externalize_label,
+	.mpo_externalize_socket_label = mls_externalize_label,
+	.mpo_externalize_socket_peer_label = mls_externalize_label,
+	.mpo_externalize_vnode_label = mls_externalize_label,
+	.mpo_internalize_cred_label = mls_internalize_label,
+	.mpo_internalize_ifnet_label = mls_internalize_label,
+	.mpo_internalize_pipe_label = mls_internalize_label,
+	.mpo_internalize_socket_label = mls_internalize_label,
+	.mpo_internalize_vnode_label = mls_internalize_label,
+	.mpo_create_devfs_device = mls_create_devfs_device,
+	.mpo_create_devfs_directory = mls_create_devfs_directory,
+	.mpo_create_devfs_symlink = mls_create_devfs_symlink,
+	.mpo_create_mount = mls_create_mount,
+	.mpo_relabel_vnode = mls_relabel_vnode,
+	.mpo_update_devfs = mls_update_devfs,
+	.mpo_associate_vnode_devfs = mls_associate_vnode_devfs,
+	.mpo_associate_vnode_extattr = mls_associate_vnode_extattr,
+	.mpo_associate_vnode_singlelabel = mls_associate_vnode_singlelabel,
+	.mpo_create_vnode_extattr = mls_create_vnode_extattr,
+	.mpo_setlabel_vnode_extattr = mls_setlabel_vnode_extattr,
+	.mpo_create_mbuf_from_socket = mls_create_mbuf_from_socket,
+	.mpo_create_mbuf_from_syncache = mls_create_mbuf_from_syncache,
+	.mpo_create_pipe = mls_create_pipe,
+	.mpo_create_posix_sem = mls_create_posix_sem,
+	.mpo_create_socket = mls_create_socket,
+	.mpo_create_socket_from_socket = mls_create_socket_from_socket,
+	.mpo_relabel_pipe = mls_relabel_pipe,
+	.mpo_relabel_socket = mls_relabel_socket,
+	.mpo_set_socket_peer_from_mbuf = mls_set_socket_peer_from_mbuf,
+	.mpo_set_socket_peer_from_socket = mls_set_socket_peer_from_socket,
+	.mpo_create_bpfdesc = mls_create_bpfdesc,
+	.mpo_create_datagram_from_ipq = mls_create_datagram_from_ipq,
+	.mpo_create_fragment = mls_create_fragment,
+	.mpo_create_ifnet = mls_create_ifnet,
+	.mpo_create_inpcb_from_socket = mls_create_inpcb_from_socket,
+	.mpo_init_syncache_from_inpcb = mls_init_syncache_from_inpcb,
+	.mpo_create_ipq = mls_create_ipq,
+	.mpo_create_sysv_msgmsg = mls_create_sysv_msgmsg,
+	.mpo_create_sysv_msgqueue = mls_create_sysv_msgqueue,
+	.mpo_create_sysv_sem = mls_create_sysv_sem,
+	.mpo_create_sysv_shm = mls_create_sysv_shm,
+	.mpo_create_mbuf_from_inpcb = mls_create_mbuf_from_inpcb,
+	.mpo_create_mbuf_linklayer = mls_create_mbuf_linklayer,
+	.mpo_create_mbuf_from_bpfdesc = mls_create_mbuf_from_bpfdesc,
+	.mpo_create_mbuf_from_ifnet = mls_create_mbuf_from_ifnet,
+	.mpo_create_mbuf_multicast_encap = mls_create_mbuf_multicast_encap,
+	.mpo_create_mbuf_netlayer = mls_create_mbuf_netlayer,
+	.mpo_fragment_match = mls_fragment_match,
+	.mpo_relabel_ifnet = mls_relabel_ifnet,
+	.mpo_update_ipq = mls_update_ipq,
+	.mpo_inpcb_sosetlabel = mls_inpcb_sosetlabel,
+	.mpo_create_proc0 = mls_create_proc0,
+	.mpo_create_proc1 = mls_create_proc1,
+	.mpo_relabel_cred = mls_relabel_cred,
+	.mpo_cleanup_sysv_msgmsg = mls_cleanup_sysv_msgmsg,
+	.mpo_cleanup_sysv_msgqueue = mls_cleanup_sysv_msgqueue,
+	.mpo_cleanup_sysv_sem = mls_cleanup_sysv_sem,
+	.mpo_cleanup_sysv_shm = mls_cleanup_sysv_shm,
+	.mpo_check_bpfdesc_receive = mls_check_bpfdesc_receive,
+	.mpo_check_cred_relabel = mls_check_cred_relabel,
+	.mpo_check_cred_visible = mls_check_cred_visible,
+	.mpo_check_ifnet_relabel = mls_check_ifnet_relabel,
+	.mpo_check_ifnet_transmit = mls_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = mls_check_inpcb_deliver,
+	.mpo_check_sysv_msgrcv = mls_check_sysv_msgrcv,
+	.mpo_check_sysv_msgrmid = mls_check_sysv_msgrmid,
+	.mpo_check_sysv_msqget = mls_check_sysv_msqget,
+	.mpo_check_sysv_msqsnd = mls_check_sysv_msqsnd,
+	.mpo_check_sysv_msqrcv = mls_check_sysv_msqrcv,
+	.mpo_check_sysv_msqctl = mls_check_sysv_msqctl,
+	.mpo_check_sysv_semctl = mls_check_sysv_semctl,
+	.mpo_check_sysv_semget = mls_check_sysv_semget,
+	.mpo_check_sysv_semop = mls_check_sysv_semop,
+	.mpo_check_sysv_shmat = mls_check_sysv_shmat,
+	.mpo_check_sysv_shmctl = mls_check_sysv_shmctl,
+	.mpo_check_sysv_shmget = mls_check_sysv_shmget,
+	.mpo_check_mount_stat = mls_check_mount_stat,
+	.mpo_check_pipe_ioctl = mls_check_pipe_ioctl,
+	.mpo_check_pipe_poll = mls_check_pipe_poll,
+	.mpo_check_pipe_read = mls_check_pipe_read,
+	.mpo_check_pipe_relabel = mls_check_pipe_relabel,
+	.mpo_check_pipe_stat = mls_check_pipe_stat,
+	.mpo_check_pipe_write = mls_check_pipe_write,
+	.mpo_check_posix_sem_destroy = mls_check_posix_sem_write,
+	.mpo_check_posix_sem_getvalue = mls_check_posix_sem_rdonly,
+	.mpo_check_posix_sem_open = mls_check_posix_sem_write,
+	.mpo_check_posix_sem_post = mls_check_posix_sem_write,
+	.mpo_check_posix_sem_unlink = mls_check_posix_sem_write,
+	.mpo_check_posix_sem_wait = mls_check_posix_sem_write,
+	.mpo_check_proc_debug = mls_check_proc_debug,
+	.mpo_check_proc_sched = mls_check_proc_sched,
+	.mpo_check_proc_signal = mls_check_proc_signal,
+	.mpo_check_socket_deliver = mls_check_socket_deliver,
+	.mpo_check_socket_relabel = mls_check_socket_relabel,
+	.mpo_check_socket_visible = mls_check_socket_visible,
+	.mpo_check_system_acct = mls_check_system_acct,
+	.mpo_check_system_auditctl = mls_check_system_auditctl,
+	.mpo_check_system_swapon = mls_check_system_swapon,
+	.mpo_check_vnode_access = mls_check_vnode_open,
+	.mpo_check_vnode_chdir = mls_check_vnode_chdir,
+	.mpo_check_vnode_chroot = mls_check_vnode_chroot,
+	.mpo_check_vnode_create = mls_check_vnode_create,
+	.mpo_check_vnode_deleteacl = mls_check_vnode_deleteacl,
+	.mpo_check_vnode_deleteextattr = mls_check_vnode_deleteextattr,
+	.mpo_check_vnode_exec = mls_check_vnode_exec,
+	.mpo_check_vnode_getacl = mls_check_vnode_getacl,
+	.mpo_check_vnode_getextattr = mls_check_vnode_getextattr,
+	.mpo_check_vnode_link = mls_check_vnode_link,
+	.mpo_check_vnode_listextattr = mls_check_vnode_listextattr,
+	.mpo_check_vnode_lookup = mls_check_vnode_lookup,
+	.mpo_check_vnode_mmap = mls_check_vnode_mmap,
+	.mpo_check_vnode_open = mls_check_vnode_open,
+	.mpo_check_vnode_poll = mls_check_vnode_poll,
+	.mpo_check_vnode_read = mls_check_vnode_read,
+	.mpo_check_vnode_readdir = mls_check_vnode_readdir,
+	.mpo_check_vnode_readlink = mls_check_vnode_readlink,
+	.mpo_check_vnode_relabel = mls_check_vnode_relabel,
+	.mpo_check_vnode_rename_from = mls_check_vnode_rename_from,
+	.mpo_check_vnode_rename_to = mls_check_vnode_rename_to,
+	.mpo_check_vnode_revoke = mls_check_vnode_revoke,
+	.mpo_check_vnode_setacl = mls_check_vnode_setacl,
+	.mpo_check_vnode_setextattr = mls_check_vnode_setextattr,
+	.mpo_check_vnode_setflags = mls_check_vnode_setflags,
+	.mpo_check_vnode_setmode = mls_check_vnode_setmode,
+	.mpo_check_vnode_setowner = mls_check_vnode_setowner,
+	.mpo_check_vnode_setutimes = mls_check_vnode_setutimes,
+	.mpo_check_vnode_stat = mls_check_vnode_stat,
+	.mpo_check_vnode_unlink = mls_check_vnode_unlink,
+	.mpo_check_vnode_write = mls_check_vnode_write,
+	.mpo_associate_nfsd_label = mls_associate_nfsd_label,
+	.mpo_create_mbuf_from_firewall = mls_create_mbuf_from_firewall,
 };
 
-MAC_POLICY_SET(&mac_mls_ops, mac_mls, "TrustedBSD MAC/MLS",
-    MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mac_mls_slot);
+MAC_POLICY_SET(&mls_ops, mac_mls, "TrustedBSD MAC/MLS",
+    MPC_LOADTIME_FLAG_NOTLATE | MPC_LOADTIME_FLAG_LABELMBUFS, &mls_slot);
diff --git a/sys/security/mac_none/mac_none.c b/sys/security/mac_none/mac_none.c
index d1036d870472..8577c730be30 100644
--- a/sys/security/mac_none/mac_none.c
+++ b/sys/security/mac_none/mac_none.c
@@ -48,9 +48,9 @@
 
 #include <security/mac/mac_policy.h>
 
-static struct mac_policy_ops mac_none_ops =
+static struct mac_policy_ops none_ops =
 {
 };
 
-MAC_POLICY_SET(&mac_none_ops, mac_none, "TrustedBSD MAC/None",
+MAC_POLICY_SET(&none_ops, mac_none, "TrustedBSD MAC/None",
     MPC_LOADTIME_FLAG_UNLOADOK, NULL);
diff --git a/sys/security/mac_partition/mac_partition.c b/sys/security/mac_partition/mac_partition.c
index c418d3f3450a..8a18f5c41cdb 100644
--- a/sys/security/mac_partition/mac_partition.c
+++ b/sys/security/mac_partition/mac_partition.c
@@ -36,6 +36,7 @@
 
 /*
  * Developed by the TrustedBSD Project.
+ *
  * Experiment with a partition-like model.
  */
 
@@ -56,37 +57,37 @@ SYSCTL_DECL(_security_mac);
 SYSCTL_NODE(_security_mac, OID_AUTO, partition, CTLFLAG_RW, 0,
     "TrustedBSD mac_partition policy controls");
 
-static int	mac_partition_enabled = 1;
+static int	partition_enabled = 1;
 SYSCTL_INT(_security_mac_partition, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_partition_enabled, 0, "Enforce partition policy");
+    &partition_enabled, 0, "Enforce partition policy");
 
 static int	partition_slot;
 #define	SLOT(l)	mac_label_get((l), partition_slot)
 #define	SLOT_SET(l, v)	mac_label_set((l), partition_slot, (v))
 
 static void
-mac_partition_init_label(struct label *label)
+partition_init_label(struct label *label)
 {
 
 	SLOT_SET(label, 0);
 }
 
 static void
-mac_partition_destroy_label(struct label *label)
+partition_destroy_label(struct label *label)
 {
 
 	SLOT_SET(label, 0);
 }
 
 static void
-mac_partition_copy_label(struct label *src, struct label *dest)
+partition_copy_label(struct label *src, struct label *dest)
 {
 
 	SLOT_SET(dest, SLOT(src));
 }
 
 static int
-mac_partition_externalize_label(struct label *label, char *element_name,
+partition_externalize_label(struct label *label, char *element_name,
     struct sbuf *sb, int *claimed)
 {
 
@@ -102,7 +103,7 @@ mac_partition_externalize_label(struct label *label, char *element_name,
 }
 
 static int
-mac_partition_internalize_label(struct label *label, char *element_name,
+partition_internalize_label(struct label *label, char *element_name,
     char *element_data, int *claimed)
 {
 
@@ -115,21 +116,21 @@ mac_partition_internalize_label(struct label *label, char *element_name,
 }
 
 static void
-mac_partition_create_proc0(struct ucred *cred)
+partition_create_proc0(struct ucred *cred)
 {
 
 	SLOT_SET(cred->cr_label, 0);
 }
 
 static void
-mac_partition_create_proc1(struct ucred *cred)
+partition_create_proc1(struct ucred *cred)
 {
 
 	SLOT_SET(cred->cr_label, 0);
 }
 
 static void
-mac_partition_relabel_cred(struct ucred *cred, struct label *newlabel)
+partition_relabel_cred(struct ucred *cred, struct label *newlabel)
 {
 
 	if (SLOT(newlabel) != 0)
@@ -140,7 +141,7 @@ static int
 label_on_label(struct label *subject, struct label *object)
 {
 
-	if (mac_partition_enabled == 0)
+	if (partition_enabled == 0)
 		return (0);
 
 	if (SLOT(subject) == 0)
@@ -153,7 +154,7 @@ label_on_label(struct label *subject, struct label *object)
 }
 
 static int
-mac_partition_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+partition_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 {
 	int error;
 
@@ -174,7 +175,7 @@ mac_partition_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 }
 
 static int
-mac_partition_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
+partition_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
 {
 	int error;
 
@@ -184,7 +185,7 @@ mac_partition_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
 }
 
 static int
-mac_partition_check_proc_debug(struct ucred *cred, struct proc *p)
+partition_check_proc_debug(struct ucred *cred, struct proc *p)
 {
 	int error;
 
@@ -194,7 +195,7 @@ mac_partition_check_proc_debug(struct ucred *cred, struct proc *p)
 }
 
 static int
-mac_partition_check_proc_sched(struct ucred *cred, struct proc *p)
+partition_check_proc_sched(struct ucred *cred, struct proc *p)
 {
 	int error;
 
@@ -204,7 +205,7 @@ mac_partition_check_proc_sched(struct ucred *cred, struct proc *p)
 }
 
 static int
-mac_partition_check_proc_signal(struct ucred *cred, struct proc *p,
+partition_check_proc_signal(struct ucred *cred, struct proc *p,
     int signum)
 {
 	int error;
@@ -215,7 +216,7 @@ mac_partition_check_proc_signal(struct ucred *cred, struct proc *p,
 }
 
 static int
-mac_partition_check_socket_visible(struct ucred *cred, struct socket *so,
+partition_check_socket_visible(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 	int error;
@@ -226,7 +227,7 @@ mac_partition_check_socket_visible(struct ucred *cred, struct socket *so,
 }
 
 static int
-mac_partition_check_vnode_exec(struct ucred *cred, struct vnode *vp,
+partition_check_vnode_exec(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct image_params *imgp,
     struct label *execlabel)
 {
@@ -244,24 +245,24 @@ mac_partition_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 	return (0);
 }
 
-static struct mac_policy_ops mac_partition_ops =
+static struct mac_policy_ops partition_ops =
 {
-	.mpo_init_cred_label = mac_partition_init_label,
-	.mpo_destroy_cred_label = mac_partition_destroy_label,
-	.mpo_copy_cred_label = mac_partition_copy_label,
-	.mpo_externalize_cred_label = mac_partition_externalize_label,
-	.mpo_internalize_cred_label = mac_partition_internalize_label,
-	.mpo_create_proc0 = mac_partition_create_proc0,
-	.mpo_create_proc1 = mac_partition_create_proc1,
-	.mpo_relabel_cred = mac_partition_relabel_cred,
-	.mpo_check_cred_relabel = mac_partition_check_cred_relabel,
-	.mpo_check_cred_visible = mac_partition_check_cred_visible,
-	.mpo_check_proc_debug = mac_partition_check_proc_debug,
-	.mpo_check_proc_sched = mac_partition_check_proc_sched,
-	.mpo_check_proc_signal = mac_partition_check_proc_signal,
-	.mpo_check_socket_visible = mac_partition_check_socket_visible,
-	.mpo_check_vnode_exec = mac_partition_check_vnode_exec,
+	.mpo_init_cred_label = partition_init_label,
+	.mpo_destroy_cred_label = partition_destroy_label,
+	.mpo_copy_cred_label = partition_copy_label,
+	.mpo_externalize_cred_label = partition_externalize_label,
+	.mpo_internalize_cred_label = partition_internalize_label,
+	.mpo_create_proc0 = partition_create_proc0,
+	.mpo_create_proc1 = partition_create_proc1,
+	.mpo_relabel_cred = partition_relabel_cred,
+	.mpo_check_cred_relabel = partition_check_cred_relabel,
+	.mpo_check_cred_visible = partition_check_cred_visible,
+	.mpo_check_proc_debug = partition_check_proc_debug,
+	.mpo_check_proc_sched = partition_check_proc_sched,
+	.mpo_check_proc_signal = partition_check_proc_signal,
+	.mpo_check_socket_visible = partition_check_socket_visible,
+	.mpo_check_vnode_exec = partition_check_vnode_exec,
 };
 
-MAC_POLICY_SET(&mac_partition_ops, mac_partition, "TrustedBSD MAC/Partition",
+MAC_POLICY_SET(&partition_ops, mac_partition, "TrustedBSD MAC/Partition",
     MPC_LOADTIME_FLAG_UNLOADOK, &partition_slot);
diff --git a/sys/security/mac_portacl/mac_portacl.c b/sys/security/mac_portacl/mac_portacl.c
index 633f606e1972..3f52eb8652be 100644
--- a/sys/security/mac_portacl/mac_portacl.c
+++ b/sys/security/mac_portacl/mac_portacl.c
@@ -44,15 +44,15 @@
  * out-going connections where the process hasn't explicitly selected a port:
  * these are automatically selected by the IP stack.
  *
- * To use this module, security.mac.enforce_socket must be enabled, and
- * you will probably want to twiddle the net.inet sysctl listed above.
- * Then use sysctl(8) to modify the rules string:
+ * To use this module, security.mac.enforce_socket must be enabled, and you
+ * will probably want to twiddle the net.inet sysctl listed above.  Then use
+ * sysctl(8) to modify the rules string:
  *
  * # sysctl security.mac.portacl.rules="uid:425:tcp:80,uid:425:tcp:79"
  *
- * This ruleset, for example, permits uid 425 to bind TCP ports 80 (http)
- * and 79 (finger).  User names and group names can't be used directly
- * because the kernel only knows about uids and gids.
+ * This ruleset, for example, permits uid 425 to bind TCP ports 80 (http) and
+ * 79 (finger).  User names and group names can't be used directly because
+ * the kernel only knows about uids and gids.
  */
 
 #include <sys/param.h>
@@ -82,30 +82,30 @@ SYSCTL_DECL(_security_mac);
 SYSCTL_NODE(_security_mac, OID_AUTO, portacl, CTLFLAG_RW, 0,
     "TrustedBSD mac_portacl policy controls");
 
-static int	mac_portacl_enabled = 1;
+static int	portacl_enabled = 1;
 SYSCTL_INT(_security_mac_portacl, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_portacl_enabled, 0, "Enforce portacl policy");
-TUNABLE_INT("security.mac.portacl.enabled", &mac_portacl_enabled);
+    &portacl_enabled, 0, "Enforce portacl policy");
+TUNABLE_INT("security.mac.portacl.enabled", &portacl_enabled);
 
-static int	mac_portacl_suser_exempt = 1;
+static int	portacl_suser_exempt = 1;
 SYSCTL_INT(_security_mac_portacl, OID_AUTO, suser_exempt, CTLFLAG_RW,
-    &mac_portacl_suser_exempt, 0, "Privilege permits binding of any port");
+    &portacl_suser_exempt, 0, "Privilege permits binding of any port");
 TUNABLE_INT("security.mac.portacl.suser_exempt",
-    &mac_portacl_suser_exempt);
+    &portacl_suser_exempt);
 
-static int	mac_portacl_autoport_exempt = 1;
+static int	portacl_autoport_exempt = 1;
 SYSCTL_INT(_security_mac_portacl, OID_AUTO, autoport_exempt, CTLFLAG_RW,
-    &mac_portacl_autoport_exempt, 0, "Allow automatic allocation through "
+    &portacl_autoport_exempt, 0, "Allow automatic allocation through "
     "binding port 0 if not IP_PORTRANGELOW");
 TUNABLE_INT("security.mac.portacl.autoport_exempt",
-    &mac_portacl_autoport_exempt);
+    &portacl_autoport_exempt);
 
-static int	mac_portacl_port_high = 1023;
+static int	portacl_port_high = 1023;
 SYSCTL_INT(_security_mac_portacl, OID_AUTO, port_high, CTLFLAG_RW,
-    &mac_portacl_port_high, 0, "Highest port to enforce for");
-TUNABLE_INT("security.mac.portacl.port_high", &mac_portacl_port_high);
+    &portacl_port_high, 0, "Highest port to enforce for");
+TUNABLE_INT("security.mac.portacl.port_high", &portacl_port_high);
 
-MALLOC_DEFINE(M_PORTACL, "mac_portacl_rule", "Rules for mac_portacl");
+MALLOC_DEFINE(M_PORTACL, "portacl_rule", "Rules for mac_portacl");
 
 #define	MAC_RULE_STRING_LEN	1024
 
@@ -385,7 +385,7 @@ rules_check(struct ucred *cred, int family, int type, u_int16_t port)
 	    cred->cr_uid, family, type, port);
 #endif
 
-	if (port > mac_portacl_port_high)
+	if (port > portacl_port_high)
 		return (0);
 
 	error = EPERM;
@@ -418,7 +418,7 @@ rules_check(struct ucred *cred, int family, int type, u_int16_t port)
 	}
 	mtx_unlock(&rule_mtx);
 
-	if (error != 0 && mac_portacl_suser_exempt != 0)
+	if (error != 0 && portacl_suser_exempt != 0)
 		error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0);
 
 	return (error);
@@ -439,7 +439,7 @@ check_socket_bind(struct ucred *cred, struct socket *so,
 	u_int16_t port;
 
 	/* Only run if we are enabled. */
-	if (mac_portacl_enabled == 0)
+	if (portacl_enabled == 0)
 		return (0);
 
 	/* Only interested in IPv4 and IPv6 sockets. */
@@ -469,7 +469,7 @@ check_socket_bind(struct ucred *cred, struct socket *so,
 	 * flag exempts port 0 allocation from rule checking as long as a low
 	 * port isn't required.
 	 */
-	if (mac_portacl_autoport_exempt && port == 0) {
+	if (portacl_autoport_exempt && port == 0) {
 		inp = sotoinpcb(so);
 		if ((inp->inp_flags & INP_LOWPORT) == 0)
 			return (0);
@@ -478,12 +478,12 @@ check_socket_bind(struct ucred *cred, struct socket *so,
 	return (rules_check(cred, family, type, port));
 }
 
-static struct mac_policy_ops mac_portacl_ops =
+static struct mac_policy_ops portacl_ops =
 {
 	.mpo_destroy = destroy,
 	.mpo_init = init,
 	.mpo_check_socket_bind = check_socket_bind,
 };
 
-MAC_POLICY_SET(&mac_portacl_ops, trustedbsd_mac_portacl,
-    "TrustedBSD MAC/portacl", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
+MAC_POLICY_SET(&portacl_ops, mac_portacl, "TrustedBSD MAC/portacl",
+    MPC_LOADTIME_FLAG_UNLOADOK, NULL);
diff --git a/sys/security/mac_seeotheruids/mac_seeotheruids.c b/sys/security/mac_seeotheruids/mac_seeotheruids.c
index 1e5e4df3ef07..d9f9ef83a1fc 100644
--- a/sys/security/mac_seeotheruids/mac_seeotheruids.c
+++ b/sys/security/mac_seeotheruids/mac_seeotheruids.c
@@ -57,9 +57,9 @@ SYSCTL_DECL(_security_mac);
 SYSCTL_NODE(_security_mac, OID_AUTO, seeotheruids, CTLFLAG_RW, 0,
     "TrustedBSD mac_seeotheruids policy controls");
 
-static int	mac_seeotheruids_enabled = 1;
+static int	seeotheruids_enabled = 1;
 SYSCTL_INT(_security_mac_seeotheruids, OID_AUTO, enabled, CTLFLAG_RW,
-    &mac_seeotheruids_enabled, 0, "Enforce seeotheruids policy");
+    &seeotheruids_enabled, 0, "Enforce seeotheruids policy");
 
 /*
  * Exception: allow credentials to be aware of other credentials with the
@@ -93,10 +93,10 @@ SYSCTL_INT(_security_mac_seeotheruids, OID_AUTO, specificgid, CTLFLAG_RW,
     &specificgid, 0, "Specific gid to be exempt from seeotheruids policy");
 
 static int
-mac_seeotheruids_check(struct ucred *cr1, struct ucred *cr2)
+seeotheruids_check(struct ucred *cr1, struct ucred *cr2)
 {
 
-	if (!mac_seeotheruids_enabled)
+	if (!seeotheruids_enabled)
 		return (0);
 
 	if (primarygroup_enabled) {
@@ -122,50 +122,50 @@ mac_seeotheruids_check(struct ucred *cr1, struct ucred *cr2)
 }
 
 static int
-mac_seeotheruids_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
+seeotheruids_check_cred_visible(struct ucred *cr1, struct ucred *cr2)
 {
 
-	return (mac_seeotheruids_check(cr1, cr2));
+	return (seeotheruids_check(cr1, cr2));
 }
 
 static int
-mac_seeotheruids_check_proc_signal(struct ucred *cred, struct proc *p,
+seeotheruids_check_proc_signal(struct ucred *cred, struct proc *p,
     int signum)
 {
 
-	return (mac_seeotheruids_check(cred, p->p_ucred));
+	return (seeotheruids_check(cred, p->p_ucred));
 }
 
 static int
-mac_seeotheruids_check_proc_sched(struct ucred *cred, struct proc *p)
+seeotheruids_check_proc_sched(struct ucred *cred, struct proc *p)
 {
 
-	return (mac_seeotheruids_check(cred, p->p_ucred));
+	return (seeotheruids_check(cred, p->p_ucred));
 }
 
 static int
-mac_seeotheruids_check_proc_debug(struct ucred *cred, struct proc *p)
+seeotheruids_check_proc_debug(struct ucred *cred, struct proc *p)
 {
 
-	return (mac_seeotheruids_check(cred, p->p_ucred));
+	return (seeotheruids_check(cred, p->p_ucred));
 }
 
 static int
-mac_seeotheruids_check_socket_visible(struct ucred *cred, struct socket *so,
+seeotheruids_check_socket_visible(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
-	return (mac_seeotheruids_check(cred, so->so_cred));
+	return (seeotheruids_check(cred, so->so_cred));
 }
 
-static struct mac_policy_ops mac_seeotheruids_ops =
+static struct mac_policy_ops seeotheruids_ops =
 {
-	.mpo_check_cred_visible = mac_seeotheruids_check_cred_visible,
-	.mpo_check_proc_debug = mac_seeotheruids_check_proc_debug,
-	.mpo_check_proc_sched = mac_seeotheruids_check_proc_sched,
-	.mpo_check_proc_signal = mac_seeotheruids_check_proc_signal,
-	.mpo_check_socket_visible = mac_seeotheruids_check_socket_visible,
+	.mpo_check_cred_visible = seeotheruids_check_cred_visible,
+	.mpo_check_proc_debug = seeotheruids_check_proc_debug,
+	.mpo_check_proc_sched = seeotheruids_check_proc_sched,
+	.mpo_check_proc_signal = seeotheruids_check_proc_signal,
+	.mpo_check_socket_visible = seeotheruids_check_socket_visible,
 };
 
-MAC_POLICY_SET(&mac_seeotheruids_ops, mac_seeotheruids,
+MAC_POLICY_SET(&seeotheruids_ops, mac_seeotheruids,
     "TrustedBSD MAC/seeotheruids", MPC_LOADTIME_FLAG_UNLOADOK, NULL);
diff --git a/sys/security/mac_stub/mac_stub.c b/sys/security/mac_stub/mac_stub.c
index 8fa9a0db979e..e616e0623134 100644
--- a/sys/security/mac_stub/mac_stub.c
+++ b/sys/security/mac_stub/mac_stub.c
@@ -1434,7 +1434,7 @@ stub_priv_grant(struct ucred *cred, int priv)
 	return (EPERM);
 }
 
-static struct mac_policy_ops mac_stub_ops =
+static struct mac_policy_ops stub_ops =
 {
 	.mpo_destroy = stub_destroy,
 	.mpo_init = stub_init,
@@ -1660,5 +1660,5 @@ static struct mac_policy_ops mac_stub_ops =
 	.mpo_create_mbuf_from_syncache = stub_create_mbuf_from_syncache,
 };
 
-MAC_POLICY_SET(&mac_stub_ops, mac_stub, "TrustedBSD MAC/Stub",
+MAC_POLICY_SET(&stub_ops, mac_stub, "TrustedBSD MAC/Stub",
     MPC_LOADTIME_FLAG_UNLOADOK, NULL);
diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c
index e44a9f3ecca9..072945c1fe4a 100644
--- a/sys/security/mac_test/mac_test.c
+++ b/sys/security/mac_test/mac_test.c
@@ -148,7 +148,7 @@ SYSCTL_NODE(_security_mac_test, OID_AUTO, counter, CTLFLAG_RW, 0,
  */
 COUNTER_DECL(init_bpfdesc_label);
 static void
-mac_test_init_bpfdesc_label(struct label *label)
+test_init_bpfdesc_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_BPF);
@@ -157,7 +157,7 @@ mac_test_init_bpfdesc_label(struct label *label)
 
 COUNTER_DECL(init_cred_label);
 static void
-mac_test_init_cred_label(struct label *label)
+test_init_cred_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_CRED);
@@ -166,7 +166,7 @@ mac_test_init_cred_label(struct label *label)
 
 COUNTER_DECL(init_devfs_label);
 static void
-mac_test_init_devfs_label(struct label *label)
+test_init_devfs_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_DEVFS);
@@ -175,7 +175,7 @@ mac_test_init_devfs_label(struct label *label)
 
 COUNTER_DECL(init_ifnet_label);
 static void
-mac_test_init_ifnet_label(struct label *label)
+test_init_ifnet_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_IFNET);
@@ -184,13 +184,12 @@ mac_test_init_ifnet_label(struct label *label)
 
 COUNTER_DECL(init_inpcb_label);
 static int
-mac_test_init_inpcb_label(struct label *label, int flag)
+test_init_inpcb_label(struct label *label, int flag)
 {
 
 	if (flag & M_WAITOK)
 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
-		    "mac_test_init_inpcb_label() at %s:%d", __FILE__,
-		    __LINE__);
+		    "test_init_inpcb_label() at %s:%d", __FILE__, __LINE__);
 
 	LABEL_INIT(label, MAGIC_INPCB);
 	COUNTER_INC(init_inpcb_label);
@@ -199,7 +198,7 @@ mac_test_init_inpcb_label(struct label *label, int flag)
 
 COUNTER_DECL(init_sysv_msg_label);
 static void
-mac_test_init_sysv_msgmsg_label(struct label *label)
+test_init_sysv_msgmsg_label(struct label *label)
 {
 	LABEL_INIT(label, MAGIC_SYSV_MSG);
 	COUNTER_INC(init_sysv_msg_label);
@@ -207,7 +206,7 @@ mac_test_init_sysv_msgmsg_label(struct label *label)
 
 COUNTER_DECL(init_sysv_msq_label);
 static void
-mac_test_init_sysv_msgqueue_label(struct label *label)
+test_init_sysv_msgqueue_label(struct label *label)
 {
 	LABEL_INIT(label, MAGIC_SYSV_MSQ);
 	COUNTER_INC(init_sysv_msq_label);
@@ -215,7 +214,7 @@ mac_test_init_sysv_msgqueue_label(struct label *label)
 
 COUNTER_DECL(init_sysv_sem_label);
 static void
-mac_test_init_sysv_sem_label(struct label *label)
+test_init_sysv_sem_label(struct label *label)
 {
 	LABEL_INIT(label, MAGIC_SYSV_SEM);
 	COUNTER_INC(init_sysv_sem_label);
@@ -223,7 +222,7 @@ mac_test_init_sysv_sem_label(struct label *label)
 
 COUNTER_DECL(init_sysv_shm_label);
 static void
-mac_test_init_sysv_shm_label(struct label *label)
+test_init_sysv_shm_label(struct label *label)
 {
 	LABEL_INIT(label, MAGIC_SYSV_SHM);
 	COUNTER_INC(init_sysv_shm_label);
@@ -231,13 +230,12 @@ mac_test_init_sysv_shm_label(struct label *label)
 
 COUNTER_DECL(init_ipq_label);
 static int
-mac_test_init_ipq_label(struct label *label, int flag)
+test_init_ipq_label(struct label *label, int flag)
 {
 
 	if (flag & M_WAITOK)
 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
-		    "mac_test_init_ipq_label() at %s:%d", __FILE__,
-		    __LINE__);
+		    "test_init_ipq_label() at %s:%d", __FILE__, __LINE__);
 
 	LABEL_INIT(label, MAGIC_IPQ);
 	COUNTER_INC(init_ipq_label);
@@ -246,13 +244,12 @@ mac_test_init_ipq_label(struct label *label, int flag)
 
 COUNTER_DECL(init_mbuf_label);
 static int
-mac_test_init_mbuf_label(struct label *label, int flag)
+test_init_mbuf_label(struct label *label, int flag)
 {
 
 	if (flag & M_WAITOK)
 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
-		    "mac_test_init_mbuf_label() at %s:%d", __FILE__,
-		    __LINE__);
+		    "test_init_mbuf_label() at %s:%d", __FILE__, __LINE__);
 
 	LABEL_INIT(label, MAGIC_MBUF);
 	COUNTER_INC(init_mbuf_label);
@@ -261,7 +258,7 @@ mac_test_init_mbuf_label(struct label *label, int flag)
 
 COUNTER_DECL(init_mount_label);
 static void
-mac_test_init_mount_label(struct label *label)
+test_init_mount_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_MOUNT);
@@ -270,13 +267,12 @@ mac_test_init_mount_label(struct label *label)
 
 COUNTER_DECL(init_socket_label);
 static int
-mac_test_init_socket_label(struct label *label, int flag)
+test_init_socket_label(struct label *label, int flag)
 {
 
 	if (flag & M_WAITOK)
 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
-		    "mac_test_init_socket_label() at %s:%d", __FILE__,
-		    __LINE__);
+		    "test_init_socket_label() at %s:%d", __FILE__, __LINE__);
 
 	LABEL_INIT(label, MAGIC_SOCKET);
 	COUNTER_INC(init_socket_label);
@@ -285,12 +281,12 @@ mac_test_init_socket_label(struct label *label, int flag)
 
 COUNTER_DECL(init_socket_peer_label);
 static int
-mac_test_init_socket_peer_label(struct label *label, int flag)
+test_init_socket_peer_label(struct label *label, int flag)
 {
 
 	if (flag & M_WAITOK)
 		WITNESS_WARN(WARN_GIANTOK | WARN_SLEEPOK, NULL,
-		    "mac_test_init_socket_peer_label() at %s:%d", __FILE__,
+		    "test_init_socket_peer_label() at %s:%d", __FILE__,
 		    __LINE__);
 
 	LABEL_INIT(label, MAGIC_SOCKET);
@@ -300,7 +296,7 @@ mac_test_init_socket_peer_label(struct label *label, int flag)
 
 COUNTER_DECL(init_pipe_label);
 static void
-mac_test_init_pipe_label(struct label *label)
+test_init_pipe_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_PIPE);
@@ -309,7 +305,7 @@ mac_test_init_pipe_label(struct label *label)
 
 COUNTER_DECL(init_posix_sem_label);
 static void
-mac_test_init_posix_sem_label(struct label *label)
+test_init_posix_sem_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_POSIX_SEM);
@@ -318,7 +314,7 @@ mac_test_init_posix_sem_label(struct label *label)
 
 COUNTER_DECL(init_proc_label);
 static void
-mac_test_init_proc_label(struct label *label)
+test_init_proc_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_PROC);
@@ -327,7 +323,7 @@ mac_test_init_proc_label(struct label *label)
 
 COUNTER_DECL(init_vnode_label);
 static void
-mac_test_init_vnode_label(struct label *label)
+test_init_vnode_label(struct label *label)
 {
 
 	LABEL_INIT(label, MAGIC_VNODE);
@@ -336,7 +332,7 @@ mac_test_init_vnode_label(struct label *label)
 
 COUNTER_DECL(destroy_bpfdesc_label);
 static void
-mac_test_destroy_bpfdesc_label(struct label *label)
+test_destroy_bpfdesc_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_BPF);
@@ -345,7 +341,7 @@ mac_test_destroy_bpfdesc_label(struct label *label)
 
 COUNTER_DECL(destroy_cred_label);
 static void
-mac_test_destroy_cred_label(struct label *label)
+test_destroy_cred_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_CRED);
@@ -354,7 +350,7 @@ mac_test_destroy_cred_label(struct label *label)
 
 COUNTER_DECL(destroy_devfs_label);
 static void
-mac_test_destroy_devfs_label(struct label *label)
+test_destroy_devfs_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_DEVFS);
@@ -363,7 +359,7 @@ mac_test_destroy_devfs_label(struct label *label)
 
 COUNTER_DECL(destroy_ifnet_label);
 static void
-mac_test_destroy_ifnet_label(struct label *label)
+test_destroy_ifnet_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_IFNET);
@@ -372,7 +368,7 @@ mac_test_destroy_ifnet_label(struct label *label)
 
 COUNTER_DECL(destroy_inpcb_label);
 static void
-mac_test_destroy_inpcb_label(struct label *label)
+test_destroy_inpcb_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_INPCB);
@@ -381,7 +377,7 @@ mac_test_destroy_inpcb_label(struct label *label)
 
 COUNTER_DECL(destroy_sysv_msg_label);
 static void
-mac_test_destroy_sysv_msgmsg_label(struct label *label)
+test_destroy_sysv_msgmsg_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_SYSV_MSG);
@@ -390,7 +386,7 @@ mac_test_destroy_sysv_msgmsg_label(struct label *label)
 
 COUNTER_DECL(destroy_sysv_msq_label);
 static void
-mac_test_destroy_sysv_msgqueue_label(struct label *label)
+test_destroy_sysv_msgqueue_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_SYSV_MSQ);
@@ -399,7 +395,7 @@ mac_test_destroy_sysv_msgqueue_label(struct label *label)
 
 COUNTER_DECL(destroy_sysv_sem_label);
 static void
-mac_test_destroy_sysv_sem_label(struct label *label)
+test_destroy_sysv_sem_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_SYSV_SEM);
@@ -408,7 +404,7 @@ mac_test_destroy_sysv_sem_label(struct label *label)
 
 COUNTER_DECL(destroy_sysv_shm_label);
 static void
-mac_test_destroy_sysv_shm_label(struct label *label)
+test_destroy_sysv_shm_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_SYSV_SHM);
@@ -417,7 +413,7 @@ mac_test_destroy_sysv_shm_label(struct label *label)
 
 COUNTER_DECL(destroy_ipq_label);
 static void
-mac_test_destroy_ipq_label(struct label *label)
+test_destroy_ipq_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_IPQ);
@@ -426,7 +422,7 @@ mac_test_destroy_ipq_label(struct label *label)
 
 COUNTER_DECL(destroy_mbuf_label);
 static void
-mac_test_destroy_mbuf_label(struct label *label)
+test_destroy_mbuf_label(struct label *label)
 {
 
 	/*
@@ -443,7 +439,7 @@ mac_test_destroy_mbuf_label(struct label *label)
 
 COUNTER_DECL(destroy_mount_label);
 static void
-mac_test_destroy_mount_label(struct label *label)
+test_destroy_mount_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_MOUNT);
@@ -452,7 +448,7 @@ mac_test_destroy_mount_label(struct label *label)
 
 COUNTER_DECL(destroy_socket_label);
 static void
-mac_test_destroy_socket_label(struct label *label)
+test_destroy_socket_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_SOCKET);
@@ -461,7 +457,7 @@ mac_test_destroy_socket_label(struct label *label)
 
 COUNTER_DECL(destroy_socket_peer_label);
 static void
-mac_test_destroy_socket_peer_label(struct label *label)
+test_destroy_socket_peer_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_SOCKET);
@@ -470,7 +466,7 @@ mac_test_destroy_socket_peer_label(struct label *label)
 
 COUNTER_DECL(destroy_pipe_label);
 static void
-mac_test_destroy_pipe_label(struct label *label)
+test_destroy_pipe_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_PIPE);
@@ -479,7 +475,7 @@ mac_test_destroy_pipe_label(struct label *label)
 
 COUNTER_DECL(destroy_posix_sem_label);
 static void
-mac_test_destroy_posix_sem_label(struct label *label)
+test_destroy_posix_sem_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_POSIX_SEM);
@@ -488,7 +484,7 @@ mac_test_destroy_posix_sem_label(struct label *label)
 
 COUNTER_DECL(destroy_proc_label);
 static void
-mac_test_destroy_proc_label(struct label *label)
+test_destroy_proc_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_PROC);
@@ -497,7 +493,7 @@ mac_test_destroy_proc_label(struct label *label)
 
 COUNTER_DECL(destroy_vnode_label);
 static void
-mac_test_destroy_vnode_label(struct label *label)
+test_destroy_vnode_label(struct label *label)
 {
 
 	LABEL_DESTROY(label, MAGIC_VNODE);
@@ -506,7 +502,7 @@ mac_test_destroy_vnode_label(struct label *label)
 
 COUNTER_DECL(copy_cred_label);
 static void
-mac_test_copy_cred_label(struct label *src, struct label *dest)
+test_copy_cred_label(struct label *src, struct label *dest)
 {
 
 	LABEL_CHECK(src, MAGIC_CRED);
@@ -516,7 +512,7 @@ mac_test_copy_cred_label(struct label *src, struct label *dest)
 
 COUNTER_DECL(copy_ifnet_label);
 static void
-mac_test_copy_ifnet_label(struct label *src, struct label *dest)
+test_copy_ifnet_label(struct label *src, struct label *dest)
 {
 
 	LABEL_CHECK(src, MAGIC_IFNET);
@@ -526,7 +522,7 @@ mac_test_copy_ifnet_label(struct label *src, struct label *dest)
 
 COUNTER_DECL(copy_mbuf_label);
 static void
-mac_test_copy_mbuf_label(struct label *src, struct label *dest)
+test_copy_mbuf_label(struct label *src, struct label *dest)
 {
 
 	LABEL_CHECK(src, MAGIC_MBUF);
@@ -536,7 +532,7 @@ mac_test_copy_mbuf_label(struct label *src, struct label *dest)
 
 COUNTER_DECL(copy_pipe_label);
 static void
-mac_test_copy_pipe_label(struct label *src, struct label *dest)
+test_copy_pipe_label(struct label *src, struct label *dest)
 {
 
 	LABEL_CHECK(src, MAGIC_PIPE);
@@ -546,7 +542,7 @@ mac_test_copy_pipe_label(struct label *src, struct label *dest)
 
 COUNTER_DECL(copy_socket_label);
 static void
-mac_test_copy_socket_label(struct label *src, struct label *dest)
+test_copy_socket_label(struct label *src, struct label *dest)
 {
 
 	LABEL_CHECK(src, MAGIC_SOCKET);
@@ -556,7 +552,7 @@ mac_test_copy_socket_label(struct label *src, struct label *dest)
 
 COUNTER_DECL(copy_vnode_label);
 static void
-mac_test_copy_vnode_label(struct label *src, struct label *dest)
+test_copy_vnode_label(struct label *src, struct label *dest)
 {
 
 	LABEL_CHECK(src, MAGIC_VNODE);
@@ -566,7 +562,7 @@ mac_test_copy_vnode_label(struct label *src, struct label *dest)
 
 COUNTER_DECL(externalize_label);
 static int
-mac_test_externalize_label(struct label *label, char *element_name,
+test_externalize_label(struct label *label, char *element_name,
     struct sbuf *sb, int *claimed)
 {
 
@@ -578,7 +574,7 @@ mac_test_externalize_label(struct label *label, char *element_name,
 
 COUNTER_DECL(internalize_label);
 static int
-mac_test_internalize_label(struct label *label, char *element_name,
+test_internalize_label(struct label *label, char *element_name,
     char *element_data, int *claimed)
 {
 
@@ -589,12 +585,12 @@ mac_test_internalize_label(struct label *label, char *element_name,
 }
 
 /*
- * Labeling event operations: file system objects, and things that look
- * a lot like file system objects.
+ * Labeling event operations: file system objects, and things that look a lot
+ * like file system objects.
  */
 COUNTER_DECL(associate_vnode_devfs);
 static void
-mac_test_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
+test_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
     struct devfs_dirent *de, struct label *delabel, struct vnode *vp,
     struct label *vplabel)
 {
@@ -607,7 +603,7 @@ mac_test_associate_vnode_devfs(struct mount *mp, struct label *mplabel,
 
 COUNTER_DECL(associate_vnode_extattr);
 static int
-mac_test_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
+test_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
     struct vnode *vp, struct label *vplabel)
 {
 
@@ -620,7 +616,7 @@ mac_test_associate_vnode_extattr(struct mount *mp, struct label *mplabel,
 
 COUNTER_DECL(associate_vnode_singlelabel);
 static void
-mac_test_associate_vnode_singlelabel(struct mount *mp, struct label *mplabel,
+test_associate_vnode_singlelabel(struct mount *mp, struct label *mplabel,
     struct vnode *vp, struct label *vplabel)
 {
 
@@ -631,7 +627,7 @@ mac_test_associate_vnode_singlelabel(struct mount *mp, struct label *mplabel,
 
 COUNTER_DECL(create_devfs_device);
 static void
-mac_test_create_devfs_device(struct ucred *cred, struct mount *mp,
+test_create_devfs_device(struct ucred *cred, struct mount *mp,
     struct cdev *dev, struct devfs_dirent *de, struct label *delabel)
 {
 
@@ -643,7 +639,7 @@ mac_test_create_devfs_device(struct ucred *cred, struct mount *mp,
 
 COUNTER_DECL(create_devfs_directory);
 static void
-mac_test_create_devfs_directory(struct mount *mp, char *dirname,
+test_create_devfs_directory(struct mount *mp, char *dirname,
     int dirnamelen, struct devfs_dirent *de, struct label *delabel)
 {
 
@@ -653,7 +649,7 @@ mac_test_create_devfs_directory(struct mount *mp, char *dirname,
 
 COUNTER_DECL(create_devfs_symlink);
 static void
-mac_test_create_devfs_symlink(struct ucred *cred, struct mount *mp,
+test_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
     struct label *delabel)
 {
@@ -666,7 +662,7 @@ mac_test_create_devfs_symlink(struct ucred *cred, struct mount *mp,
 
 COUNTER_DECL(create_vnode_extattr);
 static int
-mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp,
+test_create_vnode_extattr(struct ucred *cred, struct mount *mp,
     struct label *mplabel, struct vnode *dvp, struct label *dvplabel,
     struct vnode *vp, struct label *vplabel, struct componentname *cnp)
 {
@@ -681,7 +677,7 @@ mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 
 COUNTER_DECL(create_mount);
 static void
-mac_test_create_mount(struct ucred *cred, struct mount *mp,
+test_create_mount(struct ucred *cred, struct mount *mp,
     struct label *mplabel)
 {
 
@@ -692,7 +688,7 @@ mac_test_create_mount(struct ucred *cred, struct mount *mp,
 
 COUNTER_DECL(relabel_vnode);
 static void
-mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp,
+test_relabel_vnode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *label)
 {
 
@@ -704,7 +700,7 @@ mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(setlabel_vnode_extattr);
 static int
-mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
+test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *intlabel)
 {
 
@@ -718,7 +714,7 @@ mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(update_devfs);
 static void
-mac_test_update_devfs(struct mount *mp, struct devfs_dirent *devfs_dirent,
+test_update_devfs(struct mount *mp, struct devfs_dirent *devfs_dirent,
     struct label *direntlabel, struct vnode *vp, struct label *vplabel)
 {
 
@@ -732,7 +728,7 @@ mac_test_update_devfs(struct mount *mp, struct devfs_dirent *devfs_dirent,
  */
 COUNTER_DECL(create_mbuf_from_socket);
 static void
-mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
+test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
     struct mbuf *m, struct label *mbuflabel)
 {
 
@@ -743,7 +739,7 @@ mac_test_create_mbuf_from_socket(struct socket *so, struct label *socketlabel,
 
 COUNTER_DECL(create_socket);
 static void
-mac_test_create_socket(struct ucred *cred, struct socket *socket,
+test_create_socket(struct ucred *cred, struct socket *socket,
    struct label *socketlabel)
 {
 
@@ -754,7 +750,7 @@ mac_test_create_socket(struct ucred *cred, struct socket *socket,
 
 COUNTER_DECL(create_pipe);
 static void
-mac_test_create_pipe(struct ucred *cred, struct pipepair *pp,
+test_create_pipe(struct ucred *cred, struct pipepair *pp,
    struct label *pipelabel)
 {
 
@@ -765,7 +761,7 @@ mac_test_create_pipe(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(create_posix_sem);
 static void
-mac_test_create_posix_sem(struct ucred *cred, struct ksem *ks,
+test_create_posix_sem(struct ucred *cred, struct ksem *ks,
    struct label *kslabel)
 {
 
@@ -776,7 +772,7 @@ mac_test_create_posix_sem(struct ucred *cred, struct ksem *ks,
 
 COUNTER_DECL(create_socket_from_socket);
 static void
-mac_test_create_socket_from_socket(struct socket *oldsocket,
+test_create_socket_from_socket(struct socket *oldsocket,
     struct label *oldsocketlabel, struct socket *newsocket,
     struct label *newsocketlabel)
 {
@@ -788,7 +784,7 @@ mac_test_create_socket_from_socket(struct socket *oldsocket,
 
 COUNTER_DECL(relabel_socket);
 static void
-mac_test_relabel_socket(struct ucred *cred, struct socket *socket,
+test_relabel_socket(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct label *newlabel)
 {
 
@@ -799,7 +795,7 @@ mac_test_relabel_socket(struct ucred *cred, struct socket *socket,
 
 COUNTER_DECL(relabel_pipe);
 static void
-mac_test_relabel_pipe(struct ucred *cred, struct pipepair *pp,
+test_relabel_pipe(struct ucred *cred, struct pipepair *pp,
     struct label *pipelabel, struct label *newlabel)
 {
 
@@ -811,7 +807,7 @@ mac_test_relabel_pipe(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(set_socket_peer_from_mbuf);
 static void
-mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel,
+test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel,
     struct socket *socket, struct label *socketpeerlabel)
 {
 
@@ -825,7 +821,7 @@ mac_test_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct label *mbuflabel,
  */
 COUNTER_DECL(set_socket_peer_from_socket);
 static void
-mac_test_set_socket_peer_from_socket(struct socket *oldsocket,
+test_set_socket_peer_from_socket(struct socket *oldsocket,
     struct label *oldsocketlabel, struct socket *newsocket,
     struct label *newsocketpeerlabel)
 {
@@ -837,7 +833,7 @@ mac_test_set_socket_peer_from_socket(struct socket *oldsocket,
 
 COUNTER_DECL(create_bpfdesc);
 static void
-mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
+test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
     struct label *bpflabel)
 {
 
@@ -848,7 +844,7 @@ mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
 
 COUNTER_DECL(create_datagram_from_ipq);
 static void
-mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
+test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
     struct mbuf *datagram, struct label *datagramlabel)
 {
 
@@ -859,7 +855,7 @@ mac_test_create_datagram_from_ipq(struct ipq *ipq, struct label *ipqlabel,
 
 COUNTER_DECL(create_fragment);
 static void
-mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel,
+test_create_fragment(struct mbuf *datagram, struct label *datagramlabel,
     struct mbuf *fragment, struct label *fragmentlabel)
 {
 
@@ -870,7 +866,7 @@ mac_test_create_fragment(struct mbuf *datagram, struct label *datagramlabel,
 
 COUNTER_DECL(create_ifnet);
 static void
-mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel)
+test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel)
 {
 
 	LABEL_CHECK(ifnetlabel, MAGIC_IFNET);
@@ -879,7 +875,7 @@ mac_test_create_ifnet(struct ifnet *ifnet, struct label *ifnetlabel)
 
 COUNTER_DECL(create_inpcb_from_socket);
 static void
-mac_test_create_inpcb_from_socket(struct socket *so, struct label *solabel,
+test_create_inpcb_from_socket(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 
@@ -890,7 +886,7 @@ mac_test_create_inpcb_from_socket(struct socket *so, struct label *solabel,
 
 COUNTER_DECL(create_sysv_msgmsg);
 static void
-mac_test_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
+test_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqlabel, struct msg *msgptr, struct label *msglabel)
 {
 
@@ -901,8 +897,8 @@ mac_test_create_sysv_msgmsg(struct ucred *cred, struct msqid_kernel *msqkptr,
 
 COUNTER_DECL(create_sysv_msgqueue);
 static void
-mac_test_create_sysv_msgqueue(struct ucred *cred,
-    struct msqid_kernel *msqkptr, struct label *msqlabel)
+test_create_sysv_msgqueue(struct ucred *cred, struct msqid_kernel *msqkptr,
+    struct label *msqlabel)
 {
 
 	LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ);
@@ -911,7 +907,7 @@ mac_test_create_sysv_msgqueue(struct ucred *cred,
 
 COUNTER_DECL(create_sysv_sem);
 static void
-mac_test_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
+test_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semalabel)
 {
 
@@ -921,7 +917,7 @@ mac_test_create_sysv_sem(struct ucred *cred, struct semid_kernel *semakptr,
 
 COUNTER_DECL(create_sysv_shm);
 static void
-mac_test_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
+test_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmlabel)
 {
 
@@ -931,7 +927,7 @@ mac_test_create_sysv_shm(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 COUNTER_DECL(create_ipq);
 static void
-mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,
+test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,
     struct ipq *ipq, struct label *ipqlabel)
 {
 
@@ -942,7 +938,7 @@ mac_test_create_ipq(struct mbuf *fragment, struct label *fragmentlabel,
 
 COUNTER_DECL(create_mbuf_from_inpcb);
 static void
-mac_test_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
+test_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 
@@ -953,7 +949,7 @@ mac_test_create_mbuf_from_inpcb(struct inpcb *inp, struct label *inplabel,
 
 COUNTER_DECL(create_mbuf_linklayer);
 static void
-mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel,
+test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel,
     struct mbuf *mbuf, struct label *mbuflabel)
 {
 
@@ -964,7 +960,7 @@ mac_test_create_mbuf_linklayer(struct ifnet *ifnet, struct label *ifnetlabel,
 
 COUNTER_DECL(create_mbuf_from_bpfdesc);
 static void
-mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel,
+test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel,
     struct mbuf *mbuf, struct label *mbuflabel)
 {
 
@@ -975,7 +971,7 @@ mac_test_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct label *bpflabel,
 
 COUNTER_DECL(create_mbuf_from_ifnet);
 static void
-mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel,
+test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel,
     struct mbuf *m, struct label *mbuflabel)
 {
 
@@ -986,7 +982,7 @@ mac_test_create_mbuf_from_ifnet(struct ifnet *ifnet, struct label *ifnetlabel,
 
 COUNTER_DECL(create_mbuf_multicast_encap);
 static void
-mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf,
+test_create_mbuf_multicast_encap(struct mbuf *oldmbuf,
     struct label *oldmbuflabel, struct ifnet *ifnet, struct label *ifnetlabel,
     struct mbuf *newmbuf, struct label *newmbuflabel)
 {
@@ -999,9 +995,8 @@ mac_test_create_mbuf_multicast_encap(struct mbuf *oldmbuf,
 
 COUNTER_DECL(create_mbuf_netlayer);
 static void
-mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf,
-    struct label *oldmbuflabel, struct mbuf *newmbuf,
-    struct label *newmbuflabel)
+test_create_mbuf_netlayer(struct mbuf *oldmbuf, struct label *oldmbuflabel,
+    struct mbuf *newmbuf, struct label *newmbuflabel)
 {
 
 	LABEL_CHECK(oldmbuflabel, MAGIC_MBUF);
@@ -1011,7 +1006,7 @@ mac_test_create_mbuf_netlayer(struct mbuf *oldmbuf,
 
 COUNTER_DECL(fragment_match);
 static int
-mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel,
+test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel,
     struct ipq *ipq, struct label *ipqlabel)
 {
 
@@ -1024,7 +1019,7 @@ mac_test_fragment_match(struct mbuf *fragment, struct label *fragmentlabel,
 
 COUNTER_DECL(reflect_mbuf_icmp);
 static void
-mac_test_reflect_mbuf_icmp(struct mbuf *m, struct label *mlabel)
+test_reflect_mbuf_icmp(struct mbuf *m, struct label *mlabel)
 {
 
 	LABEL_CHECK(mlabel, MAGIC_MBUF);
@@ -1033,7 +1028,7 @@ mac_test_reflect_mbuf_icmp(struct mbuf *m, struct label *mlabel)
 
 COUNTER_DECL(reflect_mbuf_tcp);
 static void
-mac_test_reflect_mbuf_tcp(struct mbuf *m, struct label *mlabel)
+test_reflect_mbuf_tcp(struct mbuf *m, struct label *mlabel)
 {
 
 	LABEL_CHECK(mlabel, MAGIC_MBUF);
@@ -1042,7 +1037,7 @@ mac_test_reflect_mbuf_tcp(struct mbuf *m, struct label *mlabel)
 
 COUNTER_DECL(relabel_ifnet);
 static void
-mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,
+test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,
     struct label *ifnetlabel, struct label *newlabel)
 {
 
@@ -1054,7 +1049,7 @@ mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,
 
 COUNTER_DECL(update_ipq);
 static void
-mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
+test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
     struct ipq *ipq, struct label *ipqlabel)
 {
 
@@ -1065,7 +1060,7 @@ mac_test_update_ipq(struct mbuf *fragment, struct label *fragmentlabel,
 
 COUNTER_DECL(inpcb_sosetlabel);
 static void
-mac_test_inpcb_sosetlabel(struct socket *so, struct label *solabel,
+test_inpcb_sosetlabel(struct socket *so, struct label *solabel,
     struct inpcb *inp, struct label *inplabel)
 {
 
@@ -1079,10 +1074,9 @@ mac_test_inpcb_sosetlabel(struct socket *so, struct label *solabel,
  */
 COUNTER_DECL(execve_transition);
 static void
-mac_test_execve_transition(struct ucred *old, struct ucred *new,
-    struct vnode *vp, struct label *filelabel,
-    struct label *interpvplabel, struct image_params *imgp,
-    struct label *execlabel)
+test_execve_transition(struct ucred *old, struct ucred *new,
+    struct vnode *vp, struct label *filelabel, struct label *interpvplabel,
+    struct image_params *imgp, struct label *execlabel)
 {
 
 	LABEL_CHECK(old->cr_label, MAGIC_CRED);
@@ -1095,7 +1089,7 @@ mac_test_execve_transition(struct ucred *old, struct ucred *new,
 
 COUNTER_DECL(execve_will_transition);
 static int
-mac_test_execve_will_transition(struct ucred *old, struct vnode *vp,
+test_execve_will_transition(struct ucred *old, struct vnode *vp,
     struct label *filelabel, struct label *interpvplabel,
     struct image_params *imgp, struct label *execlabel)
 {
@@ -1111,7 +1105,7 @@ mac_test_execve_will_transition(struct ucred *old, struct vnode *vp,
 
 COUNTER_DECL(create_proc0);
 static void
-mac_test_create_proc0(struct ucred *cred)
+test_create_proc0(struct ucred *cred)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1120,7 +1114,7 @@ mac_test_create_proc0(struct ucred *cred)
 
 COUNTER_DECL(create_proc1);
 static void
-mac_test_create_proc1(struct ucred *cred)
+test_create_proc1(struct ucred *cred)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1129,7 +1123,7 @@ mac_test_create_proc1(struct ucred *cred)
 
 COUNTER_DECL(relabel_cred);
 static void
-mac_test_relabel_cred(struct ucred *cred, struct label *newlabel)
+test_relabel_cred(struct ucred *cred, struct label *newlabel)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1139,7 +1133,7 @@ mac_test_relabel_cred(struct ucred *cred, struct label *newlabel)
 
 COUNTER_DECL(thread_userret);
 static void
-mac_test_thread_userret(struct thread *td)
+test_thread_userret(struct thread *td)
 {
 
 	COUNTER_INC(thread_userret);
@@ -1150,7 +1144,7 @@ mac_test_thread_userret(struct thread *td)
  */
 COUNTER_DECL(cleanup_sysv_msgmsg);
 static void
-mac_test_cleanup_sysv_msgmsg(struct label *msglabel)
+test_cleanup_sysv_msgmsg(struct label *msglabel)
 {
 
 	LABEL_CHECK(msglabel, MAGIC_SYSV_MSG);
@@ -1159,7 +1153,7 @@ mac_test_cleanup_sysv_msgmsg(struct label *msglabel)
 
 COUNTER_DECL(cleanup_sysv_msgqueue);
 static void
-mac_test_cleanup_sysv_msgqueue(struct label *msqlabel)
+test_cleanup_sysv_msgqueue(struct label *msqlabel)
 {
 
 	LABEL_CHECK(msqlabel, MAGIC_SYSV_MSQ);
@@ -1168,7 +1162,7 @@ mac_test_cleanup_sysv_msgqueue(struct label *msqlabel)
 
 COUNTER_DECL(cleanup_sysv_sem);
 static void
-mac_test_cleanup_sysv_sem(struct label *semalabel)
+test_cleanup_sysv_sem(struct label *semalabel)
 {
 
 	LABEL_CHECK(semalabel, MAGIC_SYSV_SEM);
@@ -1177,7 +1171,7 @@ mac_test_cleanup_sysv_sem(struct label *semalabel)
 
 COUNTER_DECL(cleanup_sysv_shm);
 static void
-mac_test_cleanup_sysv_shm(struct label *shmlabel)
+test_cleanup_sysv_shm(struct label *shmlabel)
 {
 
 	LABEL_CHECK(shmlabel, MAGIC_SYSV_SHM);
@@ -1189,7 +1183,7 @@ mac_test_cleanup_sysv_shm(struct label *shmlabel)
  */
 COUNTER_DECL(check_bpfdesc_receive);
 static int
-mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel,
+test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel,
     struct ifnet *ifnet, struct label *ifnetlabel)
 {
 
@@ -1202,7 +1196,7 @@ mac_test_check_bpfdesc_receive(struct bpf_d *bpf_d, struct label *bpflabel,
 
 COUNTER_DECL(check_cred_relabel);
 static int
-mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel)
+test_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1214,7 +1208,7 @@ mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 
 COUNTER_DECL(check_cred_visible);
 static int
-mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2)
+test_check_cred_visible(struct ucred *u1, struct ucred *u2)
 {
 
 	LABEL_CHECK(u1->cr_label, MAGIC_CRED);
@@ -1226,7 +1220,7 @@ mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2)
 
 COUNTER_DECL(check_ifnet_relabel);
 static int
-mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
+test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
     struct label *ifnetlabel, struct label *newlabel)
 {
 
@@ -1240,7 +1234,7 @@ mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
 
 COUNTER_DECL(check_ifnet_transmit);
 static int
-mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
+test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
     struct mbuf *m, struct label *mbuflabel)
 {
 
@@ -1253,7 +1247,7 @@ mac_test_check_ifnet_transmit(struct ifnet *ifnet, struct label *ifnetlabel,
 
 COUNTER_DECL(check_inpcb_deliver);
 static int
-mac_test_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
+test_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
     struct mbuf *m, struct label *mlabel)
 {
 
@@ -1266,7 +1260,7 @@ mac_test_check_inpcb_deliver(struct inpcb *inp, struct label *inplabel,
 
 COUNTER_DECL(check_sysv_msgmsq);
 static int
-mac_test_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr,
+test_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr,
     struct label *msglabel, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
@@ -1281,7 +1275,7 @@ mac_test_check_sysv_msgmsq(struct ucred *cred, struct msg *msgptr,
 
 COUNTER_DECL(check_sysv_msgrcv);
 static int
-mac_test_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
+test_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
     struct label *msglabel)
 {
 
@@ -1294,7 +1288,7 @@ mac_test_check_sysv_msgrcv(struct ucred *cred, struct msg *msgptr,
 
 COUNTER_DECL(check_sysv_msgrmid);
 static int
-mac_test_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
+test_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
     struct label *msglabel)
 {
 
@@ -1307,7 +1301,7 @@ mac_test_check_sysv_msgrmid(struct ucred *cred, struct msg *msgptr,
 
 COUNTER_DECL(check_sysv_msqget);
 static int
-mac_test_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
+test_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 
@@ -1320,7 +1314,7 @@ mac_test_check_sysv_msqget(struct ucred *cred, struct msqid_kernel *msqkptr,
 
 COUNTER_DECL(check_sysv_msqsnd);
 static int
-mac_test_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
+test_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 
@@ -1333,7 +1327,7 @@ mac_test_check_sysv_msqsnd(struct ucred *cred, struct msqid_kernel *msqkptr,
 
 COUNTER_DECL(check_sysv_msqrcv);
 static int
-mac_test_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
+test_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel)
 {
 
@@ -1346,7 +1340,7 @@ mac_test_check_sysv_msqrcv(struct ucred *cred, struct msqid_kernel *msqkptr,
 
 COUNTER_DECL(check_sysv_msqctl);
 static int
-mac_test_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
+test_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
     struct label *msqklabel, int cmd)
 {
 
@@ -1359,7 +1353,7 @@ mac_test_check_sysv_msqctl(struct ucred *cred, struct msqid_kernel *msqkptr,
 
 COUNTER_DECL(check_sysv_semctl);
 static int
-mac_test_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
+test_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel, int cmd)
 {
 
@@ -1372,7 +1366,7 @@ mac_test_check_sysv_semctl(struct ucred *cred, struct semid_kernel *semakptr,
 
 COUNTER_DECL(check_sysv_semget);
 static int
-mac_test_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
+test_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel)
 {
 
@@ -1385,7 +1379,7 @@ mac_test_check_sysv_semget(struct ucred *cred, struct semid_kernel *semakptr,
 
 COUNTER_DECL(check_sysv_semop);
 static int
-mac_test_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
+test_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
     struct label *semaklabel, size_t accesstype)
 {
 
@@ -1398,7 +1392,7 @@ mac_test_check_sysv_semop(struct ucred *cred, struct semid_kernel *semakptr,
 
 COUNTER_DECL(check_sysv_shmat);
 static int
-mac_test_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
+test_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int shmflg)
 {
 
@@ -1411,7 +1405,7 @@ mac_test_check_sysv_shmat(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 COUNTER_DECL(check_sysv_shmctl);
 static int
-mac_test_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
+test_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int cmd)
 {
 
@@ -1424,7 +1418,7 @@ mac_test_check_sysv_shmctl(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 COUNTER_DECL(check_sysv_shmdt);
 static int
-mac_test_check_sysv_shmdt(struct ucred *cred, struct shmid_kernel *shmsegptr,
+test_check_sysv_shmdt(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel)
 {
 
@@ -1437,7 +1431,7 @@ mac_test_check_sysv_shmdt(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 COUNTER_DECL(check_sysv_shmget);
 static int
-mac_test_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
+test_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
     struct label *shmseglabel, int shmflg)
 {
 
@@ -1450,7 +1444,7 @@ mac_test_check_sysv_shmget(struct ucred *cred, struct shmid_kernel *shmsegptr,
 
 COUNTER_DECL(check_kenv_dump);
 static int
-mac_test_check_kenv_dump(struct ucred *cred)
+test_check_kenv_dump(struct ucred *cred)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1461,7 +1455,7 @@ mac_test_check_kenv_dump(struct ucred *cred)
 
 COUNTER_DECL(check_kenv_get);
 static int
-mac_test_check_kenv_get(struct ucred *cred, char *name)
+test_check_kenv_get(struct ucred *cred, char *name)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1472,7 +1466,7 @@ mac_test_check_kenv_get(struct ucred *cred, char *name)
 
 COUNTER_DECL(check_kenv_set);
 static int
-mac_test_check_kenv_set(struct ucred *cred, char *name, char *value)
+test_check_kenv_set(struct ucred *cred, char *name, char *value)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1483,7 +1477,7 @@ mac_test_check_kenv_set(struct ucred *cred, char *name, char *value)
 
 COUNTER_DECL(check_kenv_unset);
 static int
-mac_test_check_kenv_unset(struct ucred *cred, char *name)
+test_check_kenv_unset(struct ucred *cred, char *name)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1494,7 +1488,7 @@ mac_test_check_kenv_unset(struct ucred *cred, char *name)
 
 COUNTER_DECL(check_kld_load);
 static int
-mac_test_check_kld_load(struct ucred *cred, struct vnode *vp,
+test_check_kld_load(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
 
@@ -1507,7 +1501,7 @@ mac_test_check_kld_load(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_kld_stat);
 static int
-mac_test_check_kld_stat(struct ucred *cred)
+test_check_kld_stat(struct ucred *cred)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1518,7 +1512,7 @@ mac_test_check_kld_stat(struct ucred *cred)
 
 COUNTER_DECL(check_mount_stat);
 static int
-mac_test_check_mount_stat(struct ucred *cred, struct mount *mp,
+test_check_mount_stat(struct ucred *cred, struct mount *mp,
     struct label *mplabel)
 {
 
@@ -1531,7 +1525,7 @@ mac_test_check_mount_stat(struct ucred *cred, struct mount *mp,
 
 COUNTER_DECL(check_pipe_ioctl);
 static int
-mac_test_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
+test_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
     struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data)
 {
 
@@ -1544,7 +1538,7 @@ mac_test_check_pipe_ioctl(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(check_pipe_poll);
 static int
-mac_test_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
+test_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
     struct label *pipelabel)
 {
 
@@ -1557,7 +1551,7 @@ mac_test_check_pipe_poll(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(check_pipe_read);
 static int
-mac_test_check_pipe_read(struct ucred *cred, struct pipepair *pp,
+test_check_pipe_read(struct ucred *cred, struct pipepair *pp,
     struct label *pipelabel)
 {
 
@@ -1570,7 +1564,7 @@ mac_test_check_pipe_read(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(check_pipe_relabel);
 static int
-mac_test_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
+test_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
     struct label *pipelabel, struct label *newlabel)
 {
 
@@ -1584,7 +1578,7 @@ mac_test_check_pipe_relabel(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(check_pipe_stat);
 static int
-mac_test_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
+test_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
     struct label *pipelabel)
 {
 
@@ -1597,7 +1591,7 @@ mac_test_check_pipe_stat(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(check_pipe_write);
 static int
-mac_test_check_pipe_write(struct ucred *cred, struct pipepair *pp,
+test_check_pipe_write(struct ucred *cred, struct pipepair *pp,
     struct label *pipelabel)
 {
 
@@ -1610,7 +1604,7 @@ mac_test_check_pipe_write(struct ucred *cred, struct pipepair *pp,
 
 COUNTER_DECL(check_posix_sem);
 static int
-mac_test_check_posix_sem(struct ucred *cred, struct ksem *ks,
+test_check_posix_sem(struct ucred *cred, struct ksem *ks,
     struct label *kslabel)
 {
 
@@ -1623,7 +1617,7 @@ mac_test_check_posix_sem(struct ucred *cred, struct ksem *ks,
 
 COUNTER_DECL(check_proc_debug);
 static int
-mac_test_check_proc_debug(struct ucred *cred, struct proc *p)
+test_check_proc_debug(struct ucred *cred, struct proc *p)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1635,7 +1629,7 @@ mac_test_check_proc_debug(struct ucred *cred, struct proc *p)
 
 COUNTER_DECL(check_proc_sched);
 static int
-mac_test_check_proc_sched(struct ucred *cred, struct proc *p)
+test_check_proc_sched(struct ucred *cred, struct proc *p)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1647,7 +1641,7 @@ mac_test_check_proc_sched(struct ucred *cred, struct proc *p)
 
 COUNTER_DECL(check_proc_signal);
 static int
-mac_test_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
+test_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1659,7 +1653,7 @@ mac_test_check_proc_signal(struct ucred *cred, struct proc *p, int signum)
 
 COUNTER_DECL(check_proc_setaudit);
 static int
-mac_test_check_proc_setaudit(struct ucred *cred, struct auditinfo *ai)
+test_check_proc_setaudit(struct ucred *cred, struct auditinfo *ai)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1670,7 +1664,7 @@ mac_test_check_proc_setaudit(struct ucred *cred, struct auditinfo *ai)
 
 COUNTER_DECL(check_proc_setaudit_addr);
 static int
-mac_test_check_proc_setaudit_addr(struct ucred *cred,
+test_check_proc_setaudit_addr(struct ucred *cred,
     struct auditinfo_addr *aia)
 {
 
@@ -1682,7 +1676,7 @@ mac_test_check_proc_setaudit_addr(struct ucred *cred,
 
 COUNTER_DECL(check_proc_setauid);
 static int
-mac_test_check_proc_setauid(struct ucred *cred, uid_t auid)
+test_check_proc_setauid(struct ucred *cred, uid_t auid)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1693,7 +1687,7 @@ mac_test_check_proc_setauid(struct ucred *cred, uid_t auid)
 
 COUNTER_DECL(check_proc_setuid);
 static int
-mac_test_check_proc_setuid(struct ucred *cred, uid_t uid)
+test_check_proc_setuid(struct ucred *cred, uid_t uid)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1704,7 +1698,7 @@ mac_test_check_proc_setuid(struct ucred *cred, uid_t uid)
 
 COUNTER_DECL(check_proc_euid);
 static int
-mac_test_check_proc_seteuid(struct ucred *cred, uid_t euid)
+test_check_proc_seteuid(struct ucred *cred, uid_t euid)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1715,7 +1709,7 @@ mac_test_check_proc_seteuid(struct ucred *cred, uid_t euid)
 
 COUNTER_DECL(check_proc_setgid);
 static int
-mac_test_check_proc_setgid(struct ucred *cred, gid_t gid)
+test_check_proc_setgid(struct ucred *cred, gid_t gid)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1726,7 +1720,7 @@ mac_test_check_proc_setgid(struct ucred *cred, gid_t gid)
 
 COUNTER_DECL(check_proc_setegid);
 static int
-mac_test_check_proc_setegid(struct ucred *cred, gid_t egid)
+test_check_proc_setegid(struct ucred *cred, gid_t egid)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1737,7 +1731,7 @@ mac_test_check_proc_setegid(struct ucred *cred, gid_t egid)
 
 COUNTER_DECL(check_proc_setgroups);
 static int
-mac_test_check_proc_setgroups(struct ucred *cred, int ngroups,
+test_check_proc_setgroups(struct ucred *cred, int ngroups,
 	gid_t *gidset)
 {
 
@@ -1749,7 +1743,7 @@ mac_test_check_proc_setgroups(struct ucred *cred, int ngroups,
 
 COUNTER_DECL(check_proc_setreuid);
 static int
-mac_test_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
+test_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1760,7 +1754,7 @@ mac_test_check_proc_setreuid(struct ucred *cred, uid_t ruid, uid_t euid)
 
 COUNTER_DECL(check_proc_setregid);
 static int
-mac_test_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
+test_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1771,7 +1765,7 @@ mac_test_check_proc_setregid(struct ucred *cred, gid_t rgid, gid_t egid)
 
 COUNTER_DECL(check_proc_setresuid);
 static int
-mac_test_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
+test_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
 	uid_t suid)
 {
 
@@ -1783,7 +1777,7 @@ mac_test_check_proc_setresuid(struct ucred *cred, uid_t ruid, uid_t euid,
 
 COUNTER_DECL(check_proc_setresgid);
 static int
-mac_test_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
+test_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
 	gid_t sgid)
 {
 
@@ -1795,7 +1789,7 @@ mac_test_check_proc_setresgid(struct ucred *cred, gid_t rgid, gid_t egid,
 
 COUNTER_DECL(check_proc_wait);
 static int
-mac_test_check_proc_wait(struct ucred *cred, struct proc *p)
+test_check_proc_wait(struct ucred *cred, struct proc *p)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1807,7 +1801,7 @@ mac_test_check_proc_wait(struct ucred *cred, struct proc *p)
 
 COUNTER_DECL(check_socket_accept);
 static int
-mac_test_check_socket_accept(struct ucred *cred, struct socket *so,
+test_check_socket_accept(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
@@ -1820,7 +1814,7 @@ mac_test_check_socket_accept(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_bind);
 static int
-mac_test_check_socket_bind(struct ucred *cred, struct socket *so,
+test_check_socket_bind(struct ucred *cred, struct socket *so,
     struct label *solabel, struct sockaddr *sa)
 {
 
@@ -1833,7 +1827,7 @@ mac_test_check_socket_bind(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_connect);
 static int
-mac_test_check_socket_connect(struct ucred *cred, struct socket *so,
+test_check_socket_connect(struct ucred *cred, struct socket *so,
     struct label *solabel, struct sockaddr *sa)
 {
 
@@ -1846,7 +1840,7 @@ mac_test_check_socket_connect(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_deliver);
 static int
-mac_test_check_socket_deliver(struct socket *so, struct label *solabel,
+test_check_socket_deliver(struct socket *so, struct label *solabel,
     struct mbuf *m, struct label *mlabel)
 {
 
@@ -1859,7 +1853,7 @@ mac_test_check_socket_deliver(struct socket *so, struct label *solabel,
 
 COUNTER_DECL(check_socket_listen);
 static int
-mac_test_check_socket_listen(struct ucred *cred, struct socket *so,
+test_check_socket_listen(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
@@ -1872,7 +1866,7 @@ mac_test_check_socket_listen(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_poll);
 static int
-mac_test_check_socket_poll(struct ucred *cred, struct socket *so,
+test_check_socket_poll(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
@@ -1885,7 +1879,7 @@ mac_test_check_socket_poll(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_receive);
 static int
-mac_test_check_socket_receive(struct ucred *cred, struct socket *so,
+test_check_socket_receive(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
@@ -1898,7 +1892,7 @@ mac_test_check_socket_receive(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_relabel);
 static int
-mac_test_check_socket_relabel(struct ucred *cred, struct socket *so,
+test_check_socket_relabel(struct ucred *cred, struct socket *so,
     struct label *solabel, struct label *newlabel)
 {
 
@@ -1912,7 +1906,7 @@ mac_test_check_socket_relabel(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_send);
 static int
-mac_test_check_socket_send(struct ucred *cred, struct socket *so,
+test_check_socket_send(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
@@ -1925,7 +1919,7 @@ mac_test_check_socket_send(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_stat);
 static int
-mac_test_check_socket_stat(struct ucred *cred, struct socket *so,
+test_check_socket_stat(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
@@ -1938,7 +1932,7 @@ mac_test_check_socket_stat(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_socket_visible);
 static int
-mac_test_check_socket_visible(struct ucred *cred, struct socket *so,
+test_check_socket_visible(struct ucred *cred, struct socket *so,
     struct label *solabel)
 {
 
@@ -1951,7 +1945,7 @@ mac_test_check_socket_visible(struct ucred *cred, struct socket *so,
 
 COUNTER_DECL(check_system_acct);
 static int
-mac_test_check_system_acct(struct ucred *cred, struct vnode *vp,
+test_check_system_acct(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
@@ -1964,7 +1958,7 @@ mac_test_check_system_acct(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_system_audit);
 static int
-mac_test_check_system_audit(struct ucred *cred, void *record, int length)
+test_check_system_audit(struct ucred *cred, void *record, int length)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1975,7 +1969,7 @@ mac_test_check_system_audit(struct ucred *cred, void *record, int length)
 
 COUNTER_DECL(check_system_auditctl);
 static int
-mac_test_check_system_auditctl(struct ucred *cred, struct vnode *vp,
+test_check_system_auditctl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
@@ -1988,7 +1982,7 @@ mac_test_check_system_auditctl(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_system_auditon);
 static int
-mac_test_check_system_auditon(struct ucred *cred, int cmd)
+test_check_system_auditon(struct ucred *cred, int cmd)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -1999,7 +1993,7 @@ mac_test_check_system_auditon(struct ucred *cred, int cmd)
 
 COUNTER_DECL(check_system_reboot);
 static int
-mac_test_check_system_reboot(struct ucred *cred, int how)
+test_check_system_reboot(struct ucred *cred, int how)
 {
 
 	LABEL_CHECK(cred->cr_label, MAGIC_CRED);
@@ -2010,7 +2004,7 @@ mac_test_check_system_reboot(struct ucred *cred, int how)
 
 COUNTER_DECL(check_system_swapoff);
 static int
-mac_test_check_system_swapoff(struct ucred *cred, struct vnode *vp,
+test_check_system_swapoff(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
@@ -2023,7 +2017,7 @@ mac_test_check_system_swapoff(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_system_swapon);
 static int
-mac_test_check_system_swapon(struct ucred *cred, struct vnode *vp,
+test_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
@@ -2036,7 +2030,7 @@ mac_test_check_system_swapon(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_system_sysctl);
 static int
-mac_test_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
+test_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
     void *arg1, int arg2, struct sysctl_req *req)
 {
 
@@ -2048,7 +2042,7 @@ mac_test_check_system_sysctl(struct ucred *cred, struct sysctl_oid *oidp,
 
 COUNTER_DECL(check_vnode_access);
 static int
-mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp,
+test_check_vnode_access(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int acc_mode)
 {
 
@@ -2061,7 +2055,7 @@ mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_chdir);
 static int
-mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 
@@ -2074,7 +2068,7 @@ mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_chroot);
 static int
-mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 
@@ -2087,7 +2081,7 @@ mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_create);
 static int
-mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_create(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp, struct vattr *vap)
 {
 
@@ -2100,7 +2094,7 @@ mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_deleteacl);
 static int
-mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
+test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 
@@ -2113,7 +2107,7 @@ mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_deleteextattr);
 static int
-mac_test_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
+test_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name)
 {
 
@@ -2126,7 +2120,7 @@ mac_test_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_exec);
 static int
-mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp,
+test_check_vnode_exec(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct image_params *imgp,
     struct label *execlabel)
 {
@@ -2141,7 +2135,7 @@ mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_getacl);
 static int
-mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
+test_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type)
 {
 
@@ -2154,7 +2148,7 @@ mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_getextattr);
 static int
-mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
+test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
@@ -2168,7 +2162,7 @@ mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_link);
 static int
-mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_link(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
@@ -2183,7 +2177,7 @@ mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_listextattr);
 static int
-mac_test_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
+test_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace)
 {
 
@@ -2196,7 +2190,7 @@ mac_test_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_lookup);
 static int
-mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct componentname *cnp)
 {
 
@@ -2209,7 +2203,7 @@ mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_mmap);
 static int
-mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
+test_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int prot, int flags)
 {
 
@@ -2222,7 +2216,7 @@ mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_open);
 static int
-mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp,
+test_check_vnode_open(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int acc_mode)
 {
 
@@ -2235,7 +2229,7 @@ mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_poll);
 static int
-mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
+test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 
@@ -2250,7 +2244,7 @@ mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
 
 COUNTER_DECL(check_vnode_read);
 static int
-mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
+test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 
@@ -2265,7 +2259,7 @@ mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
 
 COUNTER_DECL(check_vnode_readdir);
 static int
-mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel)
 {
 
@@ -2278,7 +2272,7 @@ mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_readlink);
 static int
-mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
+test_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
@@ -2291,7 +2285,7 @@ mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_relabel);
 static int
-mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
+test_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct label *newlabel)
 {
 
@@ -2305,7 +2299,7 @@ mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_rename_from);
 static int
-mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
@@ -2320,7 +2314,7 @@ mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_rename_to);
 static int
-mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     int samedir, struct componentname *cnp)
 {
@@ -2335,7 +2329,7 @@ mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_revoke);
 static int
-mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
+test_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
     struct label *vplabel)
 {
 
@@ -2348,7 +2342,7 @@ mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_setacl);
 static int
-mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
+test_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, acl_type_t type, struct acl *acl)
 {
 
@@ -2361,7 +2355,7 @@ mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_setextattr);
 static int
-mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
+test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, int attrnamespace, const char *name,
     struct uio *uio)
 {
@@ -2375,7 +2369,7 @@ mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_setflags);
 static int
-mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
+test_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, u_long flags)
 {
 
@@ -2388,7 +2382,7 @@ mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_setmode);
 static int
-mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
+test_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, mode_t mode)
 {
 
@@ -2401,7 +2395,7 @@ mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_setowner);
 static int
-mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
+test_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, uid_t uid, gid_t gid)
 {
 
@@ -2414,7 +2408,7 @@ mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_setutimes);
 static int
-mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
+test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
     struct label *vplabel, struct timespec atime, struct timespec mtime)
 {
 
@@ -2427,7 +2421,7 @@ mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
 
 COUNTER_DECL(check_vnode_stat);
 static int
-mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
+test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *vplabel)
 {
 
@@ -2442,7 +2436,7 @@ mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
 
 COUNTER_DECL(check_vnode_unlink);
 static int
-mac_test_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
+test_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
     struct label *dvplabel, struct vnode *vp, struct label *vplabel,
     struct componentname *cnp)
 {
@@ -2457,7 +2451,7 @@ mac_test_check_vnode_unlink(struct ucred *cred, struct vnode *dvp,
 
 COUNTER_DECL(check_vnode_write);
 static int
-mac_test_check_vnode_write(struct ucred *active_cred,
+test_check_vnode_write(struct ucred *active_cred,
     struct ucred *file_cred, struct vnode *vp, struct label *vplabel)
 {
 
@@ -2470,220 +2464,219 @@ mac_test_check_vnode_write(struct ucred *active_cred,
 	return (0);
 }
 
-static struct mac_policy_ops mac_test_ops =
-{
-	.mpo_init_bpfdesc_label = mac_test_init_bpfdesc_label,
-	.mpo_init_cred_label = mac_test_init_cred_label,
-	.mpo_init_devfs_label = mac_test_init_devfs_label,
-	.mpo_init_ifnet_label = mac_test_init_ifnet_label,
-	.mpo_init_sysv_msgmsg_label = mac_test_init_sysv_msgmsg_label,
-	.mpo_init_sysv_msgqueue_label = mac_test_init_sysv_msgqueue_label,
-	.mpo_init_sysv_sem_label = mac_test_init_sysv_sem_label,
-	.mpo_init_sysv_shm_label = mac_test_init_sysv_shm_label,
-	.mpo_init_inpcb_label = mac_test_init_inpcb_label,
-	.mpo_init_ipq_label = mac_test_init_ipq_label,
-	.mpo_init_mbuf_label = mac_test_init_mbuf_label,
-	.mpo_init_mount_label = mac_test_init_mount_label,
-	.mpo_init_pipe_label = mac_test_init_pipe_label,
-	.mpo_init_posix_sem_label = mac_test_init_posix_sem_label,
-	.mpo_init_proc_label = mac_test_init_proc_label,
-	.mpo_init_socket_label = mac_test_init_socket_label,
-	.mpo_init_socket_peer_label = mac_test_init_socket_peer_label,
-	.mpo_init_vnode_label = mac_test_init_vnode_label,
-	.mpo_destroy_bpfdesc_label = mac_test_destroy_bpfdesc_label,
-	.mpo_destroy_cred_label = mac_test_destroy_cred_label,
-	.mpo_destroy_devfs_label = mac_test_destroy_devfs_label,
-	.mpo_destroy_ifnet_label = mac_test_destroy_ifnet_label,
-	.mpo_destroy_sysv_msgmsg_label = mac_test_destroy_sysv_msgmsg_label,
-	.mpo_destroy_sysv_msgqueue_label =
-	    mac_test_destroy_sysv_msgqueue_label,
-	.mpo_destroy_sysv_sem_label = mac_test_destroy_sysv_sem_label,
-	.mpo_destroy_sysv_shm_label = mac_test_destroy_sysv_shm_label,
-	.mpo_destroy_inpcb_label = mac_test_destroy_inpcb_label,
-	.mpo_destroy_ipq_label = mac_test_destroy_ipq_label,
-	.mpo_destroy_mbuf_label = mac_test_destroy_mbuf_label,
-	.mpo_destroy_mount_label = mac_test_destroy_mount_label,
-	.mpo_destroy_pipe_label = mac_test_destroy_pipe_label,
-	.mpo_destroy_posix_sem_label = mac_test_destroy_posix_sem_label,
-	.mpo_destroy_proc_label = mac_test_destroy_proc_label,
-	.mpo_destroy_socket_label = mac_test_destroy_socket_label,
-	.mpo_destroy_socket_peer_label = mac_test_destroy_socket_peer_label,
-	.mpo_destroy_vnode_label = mac_test_destroy_vnode_label,
-	.mpo_copy_cred_label = mac_test_copy_cred_label,
-	.mpo_copy_ifnet_label = mac_test_copy_ifnet_label,
-	.mpo_copy_mbuf_label = mac_test_copy_mbuf_label,
-	.mpo_copy_pipe_label = mac_test_copy_pipe_label,
-	.mpo_copy_socket_label = mac_test_copy_socket_label,
-	.mpo_copy_vnode_label = mac_test_copy_vnode_label,
-	.mpo_externalize_cred_label = mac_test_externalize_label,
-	.mpo_externalize_ifnet_label = mac_test_externalize_label,
-	.mpo_externalize_pipe_label = mac_test_externalize_label,
-	.mpo_externalize_socket_label = mac_test_externalize_label,
-	.mpo_externalize_socket_peer_label = mac_test_externalize_label,
-	.mpo_externalize_vnode_label = mac_test_externalize_label,
-	.mpo_internalize_cred_label = mac_test_internalize_label,
-	.mpo_internalize_ifnet_label = mac_test_internalize_label,
-	.mpo_internalize_pipe_label = mac_test_internalize_label,
-	.mpo_internalize_socket_label = mac_test_internalize_label,
-	.mpo_internalize_vnode_label = mac_test_internalize_label,
-	.mpo_associate_vnode_devfs = mac_test_associate_vnode_devfs,
-	.mpo_associate_vnode_extattr = mac_test_associate_vnode_extattr,
-	.mpo_associate_vnode_singlelabel = mac_test_associate_vnode_singlelabel,
-	.mpo_create_devfs_device = mac_test_create_devfs_device,
-	.mpo_create_devfs_directory = mac_test_create_devfs_directory,
-	.mpo_create_devfs_symlink = mac_test_create_devfs_symlink,
-	.mpo_create_vnode_extattr = mac_test_create_vnode_extattr,
-	.mpo_create_mount = mac_test_create_mount,
-	.mpo_relabel_vnode = mac_test_relabel_vnode,
-	.mpo_setlabel_vnode_extattr = mac_test_setlabel_vnode_extattr,
-	.mpo_update_devfs = mac_test_update_devfs,
-	.mpo_create_mbuf_from_socket = mac_test_create_mbuf_from_socket,
-	.mpo_create_pipe = mac_test_create_pipe,
-	.mpo_create_posix_sem = mac_test_create_posix_sem,
-	.mpo_create_socket = mac_test_create_socket,
-	.mpo_create_socket_from_socket = mac_test_create_socket_from_socket,
-	.mpo_relabel_pipe = mac_test_relabel_pipe,
-	.mpo_relabel_socket = mac_test_relabel_socket,
-	.mpo_set_socket_peer_from_mbuf = mac_test_set_socket_peer_from_mbuf,
-	.mpo_set_socket_peer_from_socket = mac_test_set_socket_peer_from_socket,
-	.mpo_create_bpfdesc = mac_test_create_bpfdesc,
-	.mpo_create_ifnet = mac_test_create_ifnet,
-	.mpo_create_inpcb_from_socket = mac_test_create_inpcb_from_socket,
-	.mpo_create_sysv_msgmsg = mac_test_create_sysv_msgmsg,
-	.mpo_create_sysv_msgqueue = mac_test_create_sysv_msgqueue,
-	.mpo_create_sysv_sem = mac_test_create_sysv_sem,
-	.mpo_create_sysv_shm = mac_test_create_sysv_shm,
-	.mpo_create_datagram_from_ipq = mac_test_create_datagram_from_ipq,
-	.mpo_create_fragment = mac_test_create_fragment,
-	.mpo_create_ipq = mac_test_create_ipq,
-	.mpo_create_mbuf_from_inpcb = mac_test_create_mbuf_from_inpcb,
-	.mpo_create_mbuf_linklayer = mac_test_create_mbuf_linklayer,
-	.mpo_create_mbuf_from_bpfdesc = mac_test_create_mbuf_from_bpfdesc,
-	.mpo_create_mbuf_from_ifnet = mac_test_create_mbuf_from_ifnet,
-	.mpo_create_mbuf_multicast_encap = mac_test_create_mbuf_multicast_encap,
-	.mpo_create_mbuf_netlayer = mac_test_create_mbuf_netlayer,
-	.mpo_fragment_match = mac_test_fragment_match,
-	.mpo_reflect_mbuf_icmp = mac_test_reflect_mbuf_icmp,
-	.mpo_reflect_mbuf_tcp = mac_test_reflect_mbuf_tcp,
-	.mpo_relabel_ifnet = mac_test_relabel_ifnet,
-	.mpo_update_ipq = mac_test_update_ipq,
-	.mpo_inpcb_sosetlabel = mac_test_inpcb_sosetlabel,
-	.mpo_execve_transition = mac_test_execve_transition,
-	.mpo_execve_will_transition = mac_test_execve_will_transition,
-	.mpo_create_proc0 = mac_test_create_proc0,
-	.mpo_create_proc1 = mac_test_create_proc1,
-	.mpo_relabel_cred = mac_test_relabel_cred,
-	.mpo_thread_userret = mac_test_thread_userret,
-	.mpo_cleanup_sysv_msgmsg = mac_test_cleanup_sysv_msgmsg,
-	.mpo_cleanup_sysv_msgqueue = mac_test_cleanup_sysv_msgqueue,
-	.mpo_cleanup_sysv_sem = mac_test_cleanup_sysv_sem,
-	.mpo_cleanup_sysv_shm = mac_test_cleanup_sysv_shm,
-	.mpo_check_bpfdesc_receive = mac_test_check_bpfdesc_receive,
-	.mpo_check_cred_relabel = mac_test_check_cred_relabel,
-	.mpo_check_cred_visible = mac_test_check_cred_visible,
-	.mpo_check_ifnet_relabel = mac_test_check_ifnet_relabel,
-	.mpo_check_ifnet_transmit = mac_test_check_ifnet_transmit,
-	.mpo_check_inpcb_deliver = mac_test_check_inpcb_deliver,
-	.mpo_check_sysv_msgmsq = mac_test_check_sysv_msgmsq,
-	.mpo_check_sysv_msgrcv = mac_test_check_sysv_msgrcv,
-	.mpo_check_sysv_msgrmid = mac_test_check_sysv_msgrmid,
-	.mpo_check_sysv_msqget = mac_test_check_sysv_msqget,
-	.mpo_check_sysv_msqsnd = mac_test_check_sysv_msqsnd,
-	.mpo_check_sysv_msqrcv = mac_test_check_sysv_msqrcv,
-	.mpo_check_sysv_msqctl = mac_test_check_sysv_msqctl,
-	.mpo_check_sysv_semctl = mac_test_check_sysv_semctl,
-	.mpo_check_sysv_semget = mac_test_check_sysv_semget,
-	.mpo_check_sysv_semop = mac_test_check_sysv_semop,
-	.mpo_check_sysv_shmat = mac_test_check_sysv_shmat,
-	.mpo_check_sysv_shmctl = mac_test_check_sysv_shmctl,
-	.mpo_check_sysv_shmdt = mac_test_check_sysv_shmdt,
-	.mpo_check_sysv_shmget = mac_test_check_sysv_shmget,
-	.mpo_check_kenv_dump = mac_test_check_kenv_dump,
-	.mpo_check_kenv_get = mac_test_check_kenv_get,
-	.mpo_check_kenv_set = mac_test_check_kenv_set,
-	.mpo_check_kenv_unset = mac_test_check_kenv_unset,
-	.mpo_check_kld_load = mac_test_check_kld_load,
-	.mpo_check_kld_stat = mac_test_check_kld_stat,
-	.mpo_check_mount_stat = mac_test_check_mount_stat,
-	.mpo_check_pipe_ioctl = mac_test_check_pipe_ioctl,
-	.mpo_check_pipe_poll = mac_test_check_pipe_poll,
-	.mpo_check_pipe_read = mac_test_check_pipe_read,
-	.mpo_check_pipe_relabel = mac_test_check_pipe_relabel,
-	.mpo_check_pipe_stat = mac_test_check_pipe_stat,
-	.mpo_check_pipe_write = mac_test_check_pipe_write,
-	.mpo_check_posix_sem_destroy = mac_test_check_posix_sem,
-	.mpo_check_posix_sem_getvalue = mac_test_check_posix_sem,
-	.mpo_check_posix_sem_open = mac_test_check_posix_sem,
-	.mpo_check_posix_sem_post = mac_test_check_posix_sem,
-	.mpo_check_posix_sem_unlink = mac_test_check_posix_sem,
-	.mpo_check_posix_sem_wait = mac_test_check_posix_sem,
-	.mpo_check_proc_debug = mac_test_check_proc_debug,
-	.mpo_check_proc_sched = mac_test_check_proc_sched,
-	.mpo_check_proc_setaudit = mac_test_check_proc_setaudit,
-	.mpo_check_proc_setaudit_addr = mac_test_check_proc_setaudit_addr,
-	.mpo_check_proc_setauid = mac_test_check_proc_setauid,
-	.mpo_check_proc_setuid = mac_test_check_proc_setuid,
-	.mpo_check_proc_seteuid = mac_test_check_proc_seteuid,
-	.mpo_check_proc_setgid = mac_test_check_proc_setgid,
-	.mpo_check_proc_setegid = mac_test_check_proc_setegid,
-	.mpo_check_proc_setgroups = mac_test_check_proc_setgroups,
-	.mpo_check_proc_setreuid = mac_test_check_proc_setreuid,
-	.mpo_check_proc_setregid = mac_test_check_proc_setregid,
-	.mpo_check_proc_setresuid = mac_test_check_proc_setresuid,
-	.mpo_check_proc_setresgid = mac_test_check_proc_setresgid,
-	.mpo_check_proc_signal = mac_test_check_proc_signal,
-	.mpo_check_proc_wait = mac_test_check_proc_wait,
-	.mpo_check_socket_accept = mac_test_check_socket_accept,
-	.mpo_check_socket_bind = mac_test_check_socket_bind,
-	.mpo_check_socket_connect = mac_test_check_socket_connect,
-	.mpo_check_socket_deliver = mac_test_check_socket_deliver,
-	.mpo_check_socket_listen = mac_test_check_socket_listen,
-	.mpo_check_socket_poll = mac_test_check_socket_poll,
-	.mpo_check_socket_receive = mac_test_check_socket_receive,
-	.mpo_check_socket_relabel = mac_test_check_socket_relabel,
-	.mpo_check_socket_send = mac_test_check_socket_send,
-	.mpo_check_socket_stat = mac_test_check_socket_stat,
-	.mpo_check_socket_visible = mac_test_check_socket_visible,
-	.mpo_check_system_acct = mac_test_check_system_acct,
-	.mpo_check_system_audit = mac_test_check_system_audit,
-	.mpo_check_system_auditctl = mac_test_check_system_auditctl,
-	.mpo_check_system_auditon = mac_test_check_system_auditon,
-	.mpo_check_system_reboot = mac_test_check_system_reboot,
-	.mpo_check_system_swapoff = mac_test_check_system_swapoff,
-	.mpo_check_system_swapon = mac_test_check_system_swapon,
-	.mpo_check_system_sysctl = mac_test_check_system_sysctl,
-	.mpo_check_vnode_access = mac_test_check_vnode_access,
-	.mpo_check_vnode_chdir = mac_test_check_vnode_chdir,
-	.mpo_check_vnode_chroot = mac_test_check_vnode_chroot,
-	.mpo_check_vnode_create = mac_test_check_vnode_create,
-	.mpo_check_vnode_deleteacl = mac_test_check_vnode_deleteacl,
-	.mpo_check_vnode_deleteextattr = mac_test_check_vnode_deleteextattr,
-	.mpo_check_vnode_exec = mac_test_check_vnode_exec,
-	.mpo_check_vnode_getacl = mac_test_check_vnode_getacl,
-	.mpo_check_vnode_getextattr = mac_test_check_vnode_getextattr,
-	.mpo_check_vnode_link = mac_test_check_vnode_link,
-	.mpo_check_vnode_listextattr = mac_test_check_vnode_listextattr,
-	.mpo_check_vnode_lookup = mac_test_check_vnode_lookup,
-	.mpo_check_vnode_mmap = mac_test_check_vnode_mmap,
-	.mpo_check_vnode_open = mac_test_check_vnode_open,
-	.mpo_check_vnode_poll = mac_test_check_vnode_poll,
-	.mpo_check_vnode_read = mac_test_check_vnode_read,
-	.mpo_check_vnode_readdir = mac_test_check_vnode_readdir,
-	.mpo_check_vnode_readlink = mac_test_check_vnode_readlink,
-	.mpo_check_vnode_relabel = mac_test_check_vnode_relabel,
-	.mpo_check_vnode_rename_from = mac_test_check_vnode_rename_from,
-	.mpo_check_vnode_rename_to = mac_test_check_vnode_rename_to,
-	.mpo_check_vnode_revoke = mac_test_check_vnode_revoke,
-	.mpo_check_vnode_setacl = mac_test_check_vnode_setacl,
-	.mpo_check_vnode_setextattr = mac_test_check_vnode_setextattr,
-	.mpo_check_vnode_setflags = mac_test_check_vnode_setflags,
-	.mpo_check_vnode_setmode = mac_test_check_vnode_setmode,
-	.mpo_check_vnode_setowner = mac_test_check_vnode_setowner,
-	.mpo_check_vnode_setutimes = mac_test_check_vnode_setutimes,
-	.mpo_check_vnode_stat = mac_test_check_vnode_stat,
-	.mpo_check_vnode_unlink = mac_test_check_vnode_unlink,
-	.mpo_check_vnode_write = mac_test_check_vnode_write,
+static struct mac_policy_ops test_ops =
+{
+	.mpo_init_bpfdesc_label = test_init_bpfdesc_label,
+	.mpo_init_cred_label = test_init_cred_label,
+	.mpo_init_devfs_label = test_init_devfs_label,
+	.mpo_init_ifnet_label = test_init_ifnet_label,
+	.mpo_init_sysv_msgmsg_label = test_init_sysv_msgmsg_label,
+	.mpo_init_sysv_msgqueue_label = test_init_sysv_msgqueue_label,
+	.mpo_init_sysv_sem_label = test_init_sysv_sem_label,
+	.mpo_init_sysv_shm_label = test_init_sysv_shm_label,
+	.mpo_init_inpcb_label = test_init_inpcb_label,
+	.mpo_init_ipq_label = test_init_ipq_label,
+	.mpo_init_mbuf_label = test_init_mbuf_label,
+	.mpo_init_mount_label = test_init_mount_label,
+	.mpo_init_pipe_label = test_init_pipe_label,
+	.mpo_init_posix_sem_label = test_init_posix_sem_label,
+	.mpo_init_proc_label = test_init_proc_label,
+	.mpo_init_socket_label = test_init_socket_label,
+	.mpo_init_socket_peer_label = test_init_socket_peer_label,
+	.mpo_init_vnode_label = test_init_vnode_label,
+	.mpo_destroy_bpfdesc_label = test_destroy_bpfdesc_label,
+	.mpo_destroy_cred_label = test_destroy_cred_label,
+	.mpo_destroy_devfs_label = test_destroy_devfs_label,
+	.mpo_destroy_ifnet_label = test_destroy_ifnet_label,
+	.mpo_destroy_sysv_msgmsg_label = test_destroy_sysv_msgmsg_label,
+	.mpo_destroy_sysv_msgqueue_label = test_destroy_sysv_msgqueue_label,
+	.mpo_destroy_sysv_sem_label = test_destroy_sysv_sem_label,
+	.mpo_destroy_sysv_shm_label = test_destroy_sysv_shm_label,
+	.mpo_destroy_inpcb_label = test_destroy_inpcb_label,
+	.mpo_destroy_ipq_label = test_destroy_ipq_label,
+	.mpo_destroy_mbuf_label = test_destroy_mbuf_label,
+	.mpo_destroy_mount_label = test_destroy_mount_label,
+	.mpo_destroy_pipe_label = test_destroy_pipe_label,
+	.mpo_destroy_posix_sem_label = test_destroy_posix_sem_label,
+	.mpo_destroy_proc_label = test_destroy_proc_label,
+	.mpo_destroy_socket_label = test_destroy_socket_label,
+	.mpo_destroy_socket_peer_label = test_destroy_socket_peer_label,
+	.mpo_destroy_vnode_label = test_destroy_vnode_label,
+	.mpo_copy_cred_label = test_copy_cred_label,
+	.mpo_copy_ifnet_label = test_copy_ifnet_label,
+	.mpo_copy_mbuf_label = test_copy_mbuf_label,
+	.mpo_copy_pipe_label = test_copy_pipe_label,
+	.mpo_copy_socket_label = test_copy_socket_label,
+	.mpo_copy_vnode_label = test_copy_vnode_label,
+	.mpo_externalize_cred_label = test_externalize_label,
+	.mpo_externalize_ifnet_label = test_externalize_label,
+	.mpo_externalize_pipe_label = test_externalize_label,
+	.mpo_externalize_socket_label = test_externalize_label,
+	.mpo_externalize_socket_peer_label = test_externalize_label,
+	.mpo_externalize_vnode_label = test_externalize_label,
+	.mpo_internalize_cred_label = test_internalize_label,
+	.mpo_internalize_ifnet_label = test_internalize_label,
+	.mpo_internalize_pipe_label = test_internalize_label,
+	.mpo_internalize_socket_label = test_internalize_label,
+	.mpo_internalize_vnode_label = test_internalize_label,
+	.mpo_associate_vnode_devfs = test_associate_vnode_devfs,
+	.mpo_associate_vnode_extattr = test_associate_vnode_extattr,
+	.mpo_associate_vnode_singlelabel = test_associate_vnode_singlelabel,
+	.mpo_create_devfs_device = test_create_devfs_device,
+	.mpo_create_devfs_directory = test_create_devfs_directory,
+	.mpo_create_devfs_symlink = test_create_devfs_symlink,
+	.mpo_create_vnode_extattr = test_create_vnode_extattr,
+	.mpo_create_mount = test_create_mount,
+	.mpo_relabel_vnode = test_relabel_vnode,
+	.mpo_setlabel_vnode_extattr = test_setlabel_vnode_extattr,
+	.mpo_update_devfs = test_update_devfs,
+	.mpo_create_mbuf_from_socket = test_create_mbuf_from_socket,
+	.mpo_create_pipe = test_create_pipe,
+	.mpo_create_posix_sem = test_create_posix_sem,
+	.mpo_create_socket = test_create_socket,
+	.mpo_create_socket_from_socket = test_create_socket_from_socket,
+	.mpo_relabel_pipe = test_relabel_pipe,
+	.mpo_relabel_socket = test_relabel_socket,
+	.mpo_set_socket_peer_from_mbuf = test_set_socket_peer_from_mbuf,
+	.mpo_set_socket_peer_from_socket = test_set_socket_peer_from_socket,
+	.mpo_create_bpfdesc = test_create_bpfdesc,
+	.mpo_create_ifnet = test_create_ifnet,
+	.mpo_create_inpcb_from_socket = test_create_inpcb_from_socket,
+	.mpo_create_sysv_msgmsg = test_create_sysv_msgmsg,
+	.mpo_create_sysv_msgqueue = test_create_sysv_msgqueue,
+	.mpo_create_sysv_sem = test_create_sysv_sem,
+	.mpo_create_sysv_shm = test_create_sysv_shm,
+	.mpo_create_datagram_from_ipq = test_create_datagram_from_ipq,
+	.mpo_create_fragment = test_create_fragment,
+	.mpo_create_ipq = test_create_ipq,
+	.mpo_create_mbuf_from_inpcb = test_create_mbuf_from_inpcb,
+	.mpo_create_mbuf_linklayer = test_create_mbuf_linklayer,
+	.mpo_create_mbuf_from_bpfdesc = test_create_mbuf_from_bpfdesc,
+	.mpo_create_mbuf_from_ifnet = test_create_mbuf_from_ifnet,
+	.mpo_create_mbuf_multicast_encap = test_create_mbuf_multicast_encap,
+	.mpo_create_mbuf_netlayer = test_create_mbuf_netlayer,
+	.mpo_fragment_match = test_fragment_match,
+	.mpo_reflect_mbuf_icmp = test_reflect_mbuf_icmp,
+	.mpo_reflect_mbuf_tcp = test_reflect_mbuf_tcp,
+	.mpo_relabel_ifnet = test_relabel_ifnet,
+	.mpo_update_ipq = test_update_ipq,
+	.mpo_inpcb_sosetlabel = test_inpcb_sosetlabel,
+	.mpo_execve_transition = test_execve_transition,
+	.mpo_execve_will_transition = test_execve_will_transition,
+	.mpo_create_proc0 = test_create_proc0,
+	.mpo_create_proc1 = test_create_proc1,
+	.mpo_relabel_cred = test_relabel_cred,
+	.mpo_thread_userret = test_thread_userret,
+	.mpo_cleanup_sysv_msgmsg = test_cleanup_sysv_msgmsg,
+	.mpo_cleanup_sysv_msgqueue = test_cleanup_sysv_msgqueue,
+	.mpo_cleanup_sysv_sem = test_cleanup_sysv_sem,
+	.mpo_cleanup_sysv_shm = test_cleanup_sysv_shm,
+	.mpo_check_bpfdesc_receive = test_check_bpfdesc_receive,
+	.mpo_check_cred_relabel = test_check_cred_relabel,
+	.mpo_check_cred_visible = test_check_cred_visible,
+	.mpo_check_ifnet_relabel = test_check_ifnet_relabel,
+	.mpo_check_ifnet_transmit = test_check_ifnet_transmit,
+	.mpo_check_inpcb_deliver = test_check_inpcb_deliver,
+	.mpo_check_sysv_msgmsq = test_check_sysv_msgmsq,
+	.mpo_check_sysv_msgrcv = test_check_sysv_msgrcv,
+	.mpo_check_sysv_msgrmid = test_check_sysv_msgrmid,
+	.mpo_check_sysv_msqget = test_check_sysv_msqget,
+	.mpo_check_sysv_msqsnd = test_check_sysv_msqsnd,
+	.mpo_check_sysv_msqrcv = test_check_sysv_msqrcv,
+	.mpo_check_sysv_msqctl = test_check_sysv_msqctl,
+	.mpo_check_sysv_semctl = test_check_sysv_semctl,
+	.mpo_check_sysv_semget = test_check_sysv_semget,
+	.mpo_check_sysv_semop = test_check_sysv_semop,
+	.mpo_check_sysv_shmat = test_check_sysv_shmat,
+	.mpo_check_sysv_shmctl = test_check_sysv_shmctl,
+	.mpo_check_sysv_shmdt = test_check_sysv_shmdt,
+	.mpo_check_sysv_shmget = test_check_sysv_shmget,
+	.mpo_check_kenv_dump = test_check_kenv_dump,
+	.mpo_check_kenv_get = test_check_kenv_get,
+	.mpo_check_kenv_set = test_check_kenv_set,
+	.mpo_check_kenv_unset = test_check_kenv_unset,
+	.mpo_check_kld_load = test_check_kld_load,
+	.mpo_check_kld_stat = test_check_kld_stat,
+	.mpo_check_mount_stat = test_check_mount_stat,
+	.mpo_check_pipe_ioctl = test_check_pipe_ioctl,
+	.mpo_check_pipe_poll = test_check_pipe_poll,
+	.mpo_check_pipe_read = test_check_pipe_read,
+	.mpo_check_pipe_relabel = test_check_pipe_relabel,
+	.mpo_check_pipe_stat = test_check_pipe_stat,
+	.mpo_check_pipe_write = test_check_pipe_write,
+	.mpo_check_posix_sem_destroy = test_check_posix_sem,
+	.mpo_check_posix_sem_getvalue = test_check_posix_sem,
+	.mpo_check_posix_sem_open = test_check_posix_sem,
+	.mpo_check_posix_sem_post = test_check_posix_sem,
+	.mpo_check_posix_sem_unlink = test_check_posix_sem,
+	.mpo_check_posix_sem_wait = test_check_posix_sem,
+	.mpo_check_proc_debug = test_check_proc_debug,
+	.mpo_check_proc_sched = test_check_proc_sched,
+	.mpo_check_proc_setaudit = test_check_proc_setaudit,
+	.mpo_check_proc_setaudit_addr = test_check_proc_setaudit_addr,
+	.mpo_check_proc_setauid = test_check_proc_setauid,
+	.mpo_check_proc_setuid = test_check_proc_setuid,
+	.mpo_check_proc_seteuid = test_check_proc_seteuid,
+	.mpo_check_proc_setgid = test_check_proc_setgid,
+	.mpo_check_proc_setegid = test_check_proc_setegid,
+	.mpo_check_proc_setgroups = test_check_proc_setgroups,
+	.mpo_check_proc_setreuid = test_check_proc_setreuid,
+	.mpo_check_proc_setregid = test_check_proc_setregid,
+	.mpo_check_proc_setresuid = test_check_proc_setresuid,
+	.mpo_check_proc_setresgid = test_check_proc_setresgid,
+	.mpo_check_proc_signal = test_check_proc_signal,
+	.mpo_check_proc_wait = test_check_proc_wait,
+	.mpo_check_socket_accept = test_check_socket_accept,
+	.mpo_check_socket_bind = test_check_socket_bind,
+	.mpo_check_socket_connect = test_check_socket_connect,
+	.mpo_check_socket_deliver = test_check_socket_deliver,
+	.mpo_check_socket_listen = test_check_socket_listen,
+	.mpo_check_socket_poll = test_check_socket_poll,
+	.mpo_check_socket_receive = test_check_socket_receive,
+	.mpo_check_socket_relabel = test_check_socket_relabel,
+	.mpo_check_socket_send = test_check_socket_send,
+	.mpo_check_socket_stat = test_check_socket_stat,
+	.mpo_check_socket_visible = test_check_socket_visible,
+	.mpo_check_system_acct = test_check_system_acct,
+	.mpo_check_system_audit = test_check_system_audit,
+	.mpo_check_system_auditctl = test_check_system_auditctl,
+	.mpo_check_system_auditon = test_check_system_auditon,
+	.mpo_check_system_reboot = test_check_system_reboot,
+	.mpo_check_system_swapoff = test_check_system_swapoff,
+	.mpo_check_system_swapon = test_check_system_swapon,
+	.mpo_check_system_sysctl = test_check_system_sysctl,
+	.mpo_check_vnode_access = test_check_vnode_access,
+	.mpo_check_vnode_chdir = test_check_vnode_chdir,
+	.mpo_check_vnode_chroot = test_check_vnode_chroot,
+	.mpo_check_vnode_create = test_check_vnode_create,
+	.mpo_check_vnode_deleteacl = test_check_vnode_deleteacl,
+	.mpo_check_vnode_deleteextattr = test_check_vnode_deleteextattr,
+	.mpo_check_vnode_exec = test_check_vnode_exec,
+	.mpo_check_vnode_getacl = test_check_vnode_getacl,
+	.mpo_check_vnode_getextattr = test_check_vnode_getextattr,
+	.mpo_check_vnode_link = test_check_vnode_link,
+	.mpo_check_vnode_listextattr = test_check_vnode_listextattr,
+	.mpo_check_vnode_lookup = test_check_vnode_lookup,
+	.mpo_check_vnode_mmap = test_check_vnode_mmap,
+	.mpo_check_vnode_open = test_check_vnode_open,
+	.mpo_check_vnode_poll = test_check_vnode_poll,
+	.mpo_check_vnode_read = test_check_vnode_read,
+	.mpo_check_vnode_readdir = test_check_vnode_readdir,
+	.mpo_check_vnode_readlink = test_check_vnode_readlink,
+	.mpo_check_vnode_relabel = test_check_vnode_relabel,
+	.mpo_check_vnode_rename_from = test_check_vnode_rename_from,
+	.mpo_check_vnode_rename_to = test_check_vnode_rename_to,
+	.mpo_check_vnode_revoke = test_check_vnode_revoke,
+	.mpo_check_vnode_setacl = test_check_vnode_setacl,
+	.mpo_check_vnode_setextattr = test_check_vnode_setextattr,
+	.mpo_check_vnode_setflags = test_check_vnode_setflags,
+	.mpo_check_vnode_setmode = test_check_vnode_setmode,
+	.mpo_check_vnode_setowner = test_check_vnode_setowner,
+	.mpo_check_vnode_setutimes = test_check_vnode_setutimes,
+	.mpo_check_vnode_stat = test_check_vnode_stat,
+	.mpo_check_vnode_unlink = test_check_vnode_unlink,
+	.mpo_check_vnode_write = test_check_vnode_write,
 };
 
-MAC_POLICY_SET(&mac_test_ops, mac_test, "TrustedBSD MAC/Test",
+MAC_POLICY_SET(&test_ops, mac_test, "TrustedBSD MAC/Test",
     MPC_LOADTIME_FLAG_UNLOADOK | MPC_LOADTIME_FLAG_LABELMBUFS, &test_slot);