29 files changed, 951 insertions, 746 deletions

diff --git a/sys/conf/files b/sys/conf/files
index 09e194404ae3..b5e3db3c99f7 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1618,6 +1618,7 @@ posix4/ksched.c	optional _kposix_priority_scheduling
 posix4/p1003_1b.c	standard
 posix4/posix4_mib.c	standard
 kern/uipc_sem.c		optional p1003_1b_semaphores
+security/mac/mac_label.c	optional mac
 security/mac/mac_net.c		optional mac
 security/mac/mac_pipe.c		optional mac
 security/mac/mac_process.c	optional mac
diff --git a/sys/fs/devfs/devfs.h b/sys/fs/devfs/devfs.h
index 7c660ec0f351..38ed7f8778d1 100644
--- a/sys/fs/devfs/devfs.h
+++ b/sys/fs/devfs/devfs.h
@@ -159,7 +159,7 @@ struct devfs_dirent {
 	mode_t	de_mode;
 	uid_t	de_uid;
 	gid_t	de_gid;
-	struct label	de_label;
+	struct label	*de_label;
 	struct timespec de_atime;
 	struct timespec de_mtime;
 	struct timespec de_ctime;
diff --git a/sys/kern/kern_exec.c b/sys/kern/kern_exec.c
index d55e9f38eb67..8df8e88f1628 100644
--- a/sys/kern/kern_exec.c
+++ b/sys/kern/kern_exec.c
@@ -167,9 +167,8 @@ kern_execve(td, fname, argv, envv, mac_p)
 	int credential_changing;
 	int textset;
 #ifdef MAC
-	struct label interplabel;	/* label of the interpreted vnode */
-	struct label execlabel;		/* optional label argument */
-	int will_transition, interplabelvalid = 0;
+	struct label *interplabel = NULL;
+	int will_transition;
 #endif
 
 	imgp = &image_params;
@@ -222,7 +221,7 @@ kern_execve(td, fname, argv, envv, mac_p)
 	imgp->auxarg_size = 0;
 
 #ifdef MAC
-	error = mac_execve_enter(imgp, mac_p, &execlabel);
+	error = mac_execve_enter(imgp, mac_p);
 	if (error) {
 		mtx_lock(&Giant);
 		goto exec_fail;
@@ -336,9 +335,8 @@ interpret:
 		/* free name buffer and old vnode */
 		NDFREE(ndp, NDF_ONLY_PNBUF);
 #ifdef MAC
-		mac_init_vnode_label(&interplabel);
-		mac_copy_vnode_label(&ndp->ni_vp->v_label, &interplabel);
-		interplabelvalid = 1;
+		interplabel = mac_vnode_label_alloc();
+		mac_copy_vnode_label(ndp->ni_vp->v_label, interplabel);
 #endif
 		vput(ndp->ni_vp);
 		vm_object_deallocate(imgp->object);
@@ -452,7 +450,7 @@ interpret:
 	    attr.va_gid;
 #ifdef MAC
 	will_transition = mac_execve_will_transition(oldcred, imgp->vp,
-	    interplabelvalid ? &interplabel : NULL, imgp);
+	    interplabel, imgp);
 	credential_changing |= will_transition;
 #endif
 
@@ -502,7 +500,7 @@ interpret:
 #ifdef MAC
 		if (will_transition) {
 			mac_execve_transition(oldcred, newcred, imgp->vp,
-			    interplabelvalid ? &interplabel : NULL, imgp);
+			    interplabel, imgp);
 		}
 #endif
 		/*
@@ -654,8 +652,8 @@ exec_fail:
 		/* sorry, no more process anymore. exit gracefully */
 #ifdef MAC
 		mac_execve_exit(imgp);
-		if (interplabelvalid)
-			mac_destroy_vnode_label(&interplabel);
+		if (interplabel != NULL)
+			mac_vnode_label_free(interplabel);
 #endif
 		exit1(td, W_EXITCODE(0, SIGABRT));
 		/* NOT REACHED */
@@ -664,8 +662,8 @@ exec_fail:
 done2:
 #ifdef MAC
 	mac_execve_exit(imgp);
-	if (interplabelvalid)
-		mac_destroy_vnode_label(&interplabel);
+	if (interplabel != NULL)
+		mac_vnode_label_free(interplabel);
 #endif
 	mtx_unlock(&Giant);
 	return (error);
diff --git a/sys/kern/kern_mac.c b/sys/kern/kern_mac.c
index c45900379dcb..f9adf9bee8d0 100644
--- a/sys/kern/kern_mac.c
+++ b/sys/kern/kern_mac.c
@@ -256,6 +256,7 @@ mac_init(void)
 
 	LIST_INIT(&mac_static_policy_list);
 	LIST_INIT(&mac_policy_list);
+	mac_labelzone_init();
 
 	mtx_init(&mac_policy_mtx, "mac_policy_mtx", NULL, MTX_DEF);
 	cv_init(&mac_policy_cv, "mac_policy_cv");
@@ -565,7 +566,7 @@ __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
 	}
 
 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_cred_label(&tcred->cr_label, elements,
+	error = mac_externalize_cred_label(tcred->cr_label, elements,
 	    buffer, mac.m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -602,7 +603,7 @@ __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
 	}
 
 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_cred_label(&td->td_ucred->cr_label,
+	error = mac_externalize_cred_label(td->td_ucred->cr_label,
 	    elements, buffer, mac.m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -619,7 +620,7 @@ int
 __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 {
 	struct ucred *newcred, *oldcred;
-	struct label intlabel;
+	struct label *intlabel;
 	struct proc *p;
 	struct mac mac;
 	char *buffer;
@@ -640,13 +641,11 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 		return (error);
 	}
 
-	mac_init_cred_label(&intlabel);
-	error = mac_internalize_cred_label(&intlabel, buffer);
+	intlabel = mac_cred_label_alloc();
+	error = mac_internalize_cred_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_cred_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	newcred = crget();
 
@@ -654,7 +653,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
 
-	error = mac_check_cred_relabel(oldcred, &intlabel);
+	error = mac_check_cred_relabel(oldcred, intlabel);
 	if (error) {
 		PROC_UNLOCK(p);
 		crfree(newcred);
@@ -663,7 +662,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 
 	setsugid(p);
 	crcopy(newcred, oldcred);
-	mac_relabel_cred(newcred, &intlabel);
+	mac_relabel_cred(newcred, intlabel);
 	p->p_ucred = newcred;
 
 	/*
@@ -683,7 +682,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 	crfree(oldcred);
 
 out:
-	mac_destroy_cred_label(&intlabel);
+	mac_cred_label_free(intlabel);
 	return (error);
 }
 
@@ -694,7 +693,7 @@ int
 __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 {
 	char *elements, *buffer;
-	struct label intlabel;
+	struct label *intlabel;
 	struct file *fp;
 	struct mac mac;
 	struct vnode *vp;
@@ -729,20 +728,20 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 	case DTYPE_VNODE:
 		vp = fp->f_vnode;
 
-		mac_init_vnode_label(&intlabel);
+		intlabel = mac_vnode_label_alloc();
 
 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-		mac_copy_vnode_label(&vp->v_label, &intlabel);
+		mac_copy_vnode_label(vp->v_label, intlabel);
 		VOP_UNLOCK(vp, 0, td);
 
 		break;
 	case DTYPE_PIPE:
 		pipe = fp->f_data;
 
-		mac_init_pipe_label(&intlabel);
+		intlabel = mac_pipe_label_alloc();
 
 		PIPE_LOCK(pipe);
-		mac_copy_pipe_label(pipe->pipe_label, &intlabel);
+		mac_copy_pipe_label(pipe->pipe_label, intlabel);
 		PIPE_UNLOCK(pipe);
 		break;
 	default:
@@ -756,14 +755,14 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
 		if (error == 0)
-			error = mac_externalize_vnode_label(&intlabel,
+			error = mac_externalize_vnode_label(intlabel,
 			    elements, buffer, mac.m_buflen);
-		mac_destroy_vnode_label(&intlabel);
+		mac_vnode_label_free(intlabel);
 		break;
 	case DTYPE_PIPE:
-		error = mac_externalize_pipe_label(&intlabel, elements,
+		error = mac_externalize_pipe_label(intlabel, elements,
 		    buffer, mac.m_buflen);
-		mac_destroy_pipe_label(&intlabel);
+		mac_pipe_label_free(intlabel);
 		break;
 	default:
 		panic("__mac_get_fd: corrupted label_type");
@@ -788,7 +787,7 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
 {
 	char *elements, *buffer;
 	struct nameidata nd;
-	struct label intlabel;
+	struct label *intlabel;
 	struct mac mac;
 	int error;
 
@@ -815,13 +814,13 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
 	if (error)
 		goto out;
 
-	mac_init_vnode_label(&intlabel);
-	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
-	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
+	intlabel = mac_vnode_label_alloc();
+	mac_copy_vnode_label(nd.ni_vp->v_label, intlabel);
+	error = mac_externalize_vnode_label(intlabel, elements, buffer,
 	    mac.m_buflen);
 
 	NDFREE(&nd, 0);
-	mac_destroy_vnode_label(&intlabel);
+	mac_vnode_label_free(intlabel);
 
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -843,7 +842,7 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
 {
 	char *elements, *buffer;
 	struct nameidata nd;
-	struct label intlabel;
+	struct label *intlabel;
 	struct mac mac;
 	int error;
 
@@ -870,12 +869,12 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
 	if (error)
 		goto out;
 
-	mac_init_vnode_label(&intlabel);
-	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
-	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
+	intlabel = mac_vnode_label_alloc();
+	mac_copy_vnode_label(nd.ni_vp->v_label, intlabel);
+	error = mac_externalize_vnode_label(intlabel, elements, buffer,
 	    mac.m_buflen);
 	NDFREE(&nd, 0);
-	mac_destroy_vnode_label(&intlabel);
+	mac_vnode_label_free(intlabel);
 
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -895,7 +894,7 @@ out:
 int
 __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct pipe *pipe;
 	struct file *fp;
 	struct mount *mp;
@@ -928,40 +927,40 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 	switch (fp->f_type) {
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
-		mac_init_vnode_label(&intlabel);
-		error = mac_internalize_vnode_label(&intlabel, buffer);
+		intlabel = mac_vnode_label_alloc();
+		error = mac_internalize_vnode_label(intlabel, buffer);
 		if (error) {
-			mac_destroy_vnode_label(&intlabel);
+			mac_vnode_label_free(intlabel);
 			break;
 		}
 
 		vp = fp->f_vnode;
 		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
 		if (error != 0) {
-			mac_destroy_vnode_label(&intlabel);
+			mac_vnode_label_free(intlabel);
 			break;
 		}
 
 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		error = vn_setlabel(vp, intlabel, td->td_ucred);
 		VOP_UNLOCK(vp, 0, td);
 		vn_finished_write(mp);
 
-		mac_destroy_vnode_label(&intlabel);
+		mac_vnode_label_free(intlabel);
 		break;
 
 	case DTYPE_PIPE:
-		mac_init_pipe_label(&intlabel);
-		error = mac_internalize_pipe_label(&intlabel, buffer);
+		intlabel = mac_pipe_label_alloc();
+		error = mac_internalize_pipe_label(intlabel, buffer);
 		if (error == 0) {
 			pipe = fp->f_data;
 			PIPE_LOCK(pipe);
 			error = mac_pipe_label_set(td->td_ucred, pipe,
-			    &intlabel);
+			    intlabel);
 			PIPE_UNLOCK(pipe);
 		}
 
-		mac_destroy_pipe_label(&intlabel);
+		mac_pipe_label_free(intlabel);
 		break;
 
 	default:
@@ -983,7 +982,7 @@ out:
 int
 __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct nameidata nd;
 	struct mount *mp;
 	struct mac mac;
@@ -1005,13 +1004,11 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 		return (error);
 	}
 
-	mac_init_vnode_label(&intlabel);
-	error = mac_internalize_vnode_label(&intlabel, buffer);
+	intlabel = mac_vnode_label_alloc();
+	error = mac_internalize_vnode_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_vnode_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	mtx_lock(&Giant);				/* VFS */
 
@@ -1021,15 +1018,15 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 	if (error == 0) {
 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
 		if (error == 0)
-			error = vn_setlabel(nd.ni_vp, &intlabel,
+			error = vn_setlabel(nd.ni_vp, intlabel,
 			    td->td_ucred);
 		vn_finished_write(mp);
 	}
 
 	NDFREE(&nd, 0);
 	mtx_unlock(&Giant);				/* VFS */
-	mac_destroy_vnode_label(&intlabel);
-
+out:
+	mac_vnode_label_free(intlabel);
 	return (error);
 }
 
@@ -1039,7 +1036,7 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 int
 __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct nameidata nd;
 	struct mount *mp;
 	struct mac mac;
@@ -1061,13 +1058,11 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 		return (error);
 	}
 
-	mac_init_vnode_label(&intlabel);
-	error = mac_internalize_vnode_label(&intlabel, buffer);
+	intlabel = mac_vnode_label_alloc();
+	error = mac_internalize_vnode_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_vnode_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	mtx_lock(&Giant);				/* VFS */
 
@@ -1077,15 +1072,15 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 	if (error == 0) {
 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
 		if (error == 0)
-			error = vn_setlabel(nd.ni_vp, &intlabel,
+			error = vn_setlabel(nd.ni_vp, intlabel,
 			    td->td_ucred);
 		vn_finished_write(mp);
 	}
 
 	NDFREE(&nd, 0);
 	mtx_unlock(&Giant);				/* VFS */
-	mac_destroy_vnode_label(&intlabel);
-
+out:
+	mac_vnode_label_free(intlabel);
 	return (error);
 }
 
diff --git a/sys/net/bpfdesc.h b/sys/net/bpfdesc.h
index 73dcc90bb15a..02c79ebf4c92 100644
--- a/sys/net/bpfdesc.h
+++ b/sys/net/bpfdesc.h
@@ -43,7 +43,6 @@
 #ifndef _NET_BPFDESC_H_
 #define _NET_BPFDESC_H_
 
-#include <sys/_label.h>
 #include <sys/callout.h>
 #include <sys/selinfo.h>
 
@@ -93,7 +92,7 @@ struct bpf_d {
 #endif
 	struct mtx	bd_mtx;		/* mutex for this descriptor */
 	struct callout	bd_callout;	/* for BPF timeouts with select */
-	struct label	bd_label;	/* MAC label for descriptor */
+	struct label	*bd_label;	/* MAC label for descriptor */
 };
 
 /* Values for bd_state */
diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index 52cee5573b47..c77498f7366a 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -74,7 +74,6 @@ struct	socket;
 struct	ether_header;
 #endif
 
-#include <sys/_label.h>		/* struct label */
 #include <sys/queue.h>		/* get TAILQ macros */
 
 #ifdef _KERNEL
@@ -180,7 +179,7 @@ struct ifnet {
 	struct	ifqueue *if_poll_slowq;	/* input queue for slow devices */
 	struct	ifprefixhead if_prefixhead; /* list of prefixes per if */
 	u_int8_t *if_broadcastaddr;	/* linklevel broadcast bytestring */
-	struct	label if_label;		/* interface MAC label */
+	struct	label *if_label;	/* interface MAC label */
 
 	void	*if_afdata[AF_MAX];
 	int	if_afdata_initialized;
diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h
index 881d40c5a10b..1b9d6c5aa583 100644
--- a/sys/netinet/ip_var.h
+++ b/sys/netinet/ip_var.h
@@ -39,10 +39,6 @@
 
 #include <sys/queue.h>
 
-#ifdef _KERNEL
-#include <sys/_label.h>
-#endif
-
 /*
  * Overlay for ip header used by other protocols (tcp, udp).
  */
@@ -71,7 +67,7 @@ struct ipq {
 	u_char	ipq_nfrags;		/* # frags in this packet */
 	u_int32_t ipq_div_info;		/* ipfw divert port & flags */
 	u_int16_t ipq_div_cookie;	/* ipfw divert cookie */
-	struct label ipq_label;		/* MAC label */
+	struct label *ipq_label;		/* MAC label */
 };
 #endif /* _KERNEL */
 
diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index c45900379dcb..f9adf9bee8d0 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -256,6 +256,7 @@ mac_init(void)
 
 	LIST_INIT(&mac_static_policy_list);
 	LIST_INIT(&mac_policy_list);
+	mac_labelzone_init();
 
 	mtx_init(&mac_policy_mtx, "mac_policy_mtx", NULL, MTX_DEF);
 	cv_init(&mac_policy_cv, "mac_policy_cv");
@@ -565,7 +566,7 @@ __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
 	}
 
 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_cred_label(&tcred->cr_label, elements,
+	error = mac_externalize_cred_label(tcred->cr_label, elements,
 	    buffer, mac.m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -602,7 +603,7 @@ __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
 	}
 
 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_cred_label(&td->td_ucred->cr_label,
+	error = mac_externalize_cred_label(td->td_ucred->cr_label,
 	    elements, buffer, mac.m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -619,7 +620,7 @@ int
 __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 {
 	struct ucred *newcred, *oldcred;
-	struct label intlabel;
+	struct label *intlabel;
 	struct proc *p;
 	struct mac mac;
 	char *buffer;
@@ -640,13 +641,11 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 		return (error);
 	}
 
-	mac_init_cred_label(&intlabel);
-	error = mac_internalize_cred_label(&intlabel, buffer);
+	intlabel = mac_cred_label_alloc();
+	error = mac_internalize_cred_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_cred_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	newcred = crget();
 
@@ -654,7 +653,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
 
-	error = mac_check_cred_relabel(oldcred, &intlabel);
+	error = mac_check_cred_relabel(oldcred, intlabel);
 	if (error) {
 		PROC_UNLOCK(p);
 		crfree(newcred);
@@ -663,7 +662,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 
 	setsugid(p);
 	crcopy(newcred, oldcred);
-	mac_relabel_cred(newcred, &intlabel);
+	mac_relabel_cred(newcred, intlabel);
 	p->p_ucred = newcred;
 
 	/*
@@ -683,7 +682,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 	crfree(oldcred);
 
 out:
-	mac_destroy_cred_label(&intlabel);
+	mac_cred_label_free(intlabel);
 	return (error);
 }
 
@@ -694,7 +693,7 @@ int
 __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 {
 	char *elements, *buffer;
-	struct label intlabel;
+	struct label *intlabel;
 	struct file *fp;
 	struct mac mac;
 	struct vnode *vp;
@@ -729,20 +728,20 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 	case DTYPE_VNODE:
 		vp = fp->f_vnode;
 
-		mac_init_vnode_label(&intlabel);
+		intlabel = mac_vnode_label_alloc();
 
 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-		mac_copy_vnode_label(&vp->v_label, &intlabel);
+		mac_copy_vnode_label(vp->v_label, intlabel);
 		VOP_UNLOCK(vp, 0, td);
 
 		break;
 	case DTYPE_PIPE:
 		pipe = fp->f_data;
 
-		mac_init_pipe_label(&intlabel);
+		intlabel = mac_pipe_label_alloc();
 
 		PIPE_LOCK(pipe);
-		mac_copy_pipe_label(pipe->pipe_label, &intlabel);
+		mac_copy_pipe_label(pipe->pipe_label, intlabel);
 		PIPE_UNLOCK(pipe);
 		break;
 	default:
@@ -756,14 +755,14 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
 		if (error == 0)
-			error = mac_externalize_vnode_label(&intlabel,
+			error = mac_externalize_vnode_label(intlabel,
 			    elements, buffer, mac.m_buflen);
-		mac_destroy_vnode_label(&intlabel);
+		mac_vnode_label_free(intlabel);
 		break;
 	case DTYPE_PIPE:
-		error = mac_externalize_pipe_label(&intlabel, elements,
+		error = mac_externalize_pipe_label(intlabel, elements,
 		    buffer, mac.m_buflen);
-		mac_destroy_pipe_label(&intlabel);
+		mac_pipe_label_free(intlabel);
 		break;
 	default:
 		panic("__mac_get_fd: corrupted label_type");
@@ -788,7 +787,7 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
 {
 	char *elements, *buffer;
 	struct nameidata nd;
-	struct label intlabel;
+	struct label *intlabel;
 	struct mac mac;
 	int error;
 
@@ -815,13 +814,13 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
 	if (error)
 		goto out;
 
-	mac_init_vnode_label(&intlabel);
-	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
-	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
+	intlabel = mac_vnode_label_alloc();
+	mac_copy_vnode_label(nd.ni_vp->v_label, intlabel);
+	error = mac_externalize_vnode_label(intlabel, elements, buffer,
 	    mac.m_buflen);
 
 	NDFREE(&nd, 0);
-	mac_destroy_vnode_label(&intlabel);
+	mac_vnode_label_free(intlabel);
 
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -843,7 +842,7 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
 {
 	char *elements, *buffer;
 	struct nameidata nd;
-	struct label intlabel;
+	struct label *intlabel;
 	struct mac mac;
 	int error;
 
@@ -870,12 +869,12 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
 	if (error)
 		goto out;
 
-	mac_init_vnode_label(&intlabel);
-	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
-	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
+	intlabel = mac_vnode_label_alloc();
+	mac_copy_vnode_label(nd.ni_vp->v_label, intlabel);
+	error = mac_externalize_vnode_label(intlabel, elements, buffer,
 	    mac.m_buflen);
 	NDFREE(&nd, 0);
-	mac_destroy_vnode_label(&intlabel);
+	mac_vnode_label_free(intlabel);
 
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -895,7 +894,7 @@ out:
 int
 __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct pipe *pipe;
 	struct file *fp;
 	struct mount *mp;
@@ -928,40 +927,40 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 	switch (fp->f_type) {
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
-		mac_init_vnode_label(&intlabel);
-		error = mac_internalize_vnode_label(&intlabel, buffer);
+		intlabel = mac_vnode_label_alloc();
+		error = mac_internalize_vnode_label(intlabel, buffer);
 		if (error) {
-			mac_destroy_vnode_label(&intlabel);
+			mac_vnode_label_free(intlabel);
 			break;
 		}
 
 		vp = fp->f_vnode;
 		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
 		if (error != 0) {
-			mac_destroy_vnode_label(&intlabel);
+			mac_vnode_label_free(intlabel);
 			break;
 		}
 
 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		error = vn_setlabel(vp, intlabel, td->td_ucred);
 		VOP_UNLOCK(vp, 0, td);
 		vn_finished_write(mp);
 
-		mac_destroy_vnode_label(&intlabel);
+		mac_vnode_label_free(intlabel);
 		break;
 
 	case DTYPE_PIPE:
-		mac_init_pipe_label(&intlabel);
-		error = mac_internalize_pipe_label(&intlabel, buffer);
+		intlabel = mac_pipe_label_alloc();
+		error = mac_internalize_pipe_label(intlabel, buffer);
 		if (error == 0) {
 			pipe = fp->f_data;
 			PIPE_LOCK(pipe);
 			error = mac_pipe_label_set(td->td_ucred, pipe,
-			    &intlabel);
+			    intlabel);
 			PIPE_UNLOCK(pipe);
 		}
 
-		mac_destroy_pipe_label(&intlabel);
+		mac_pipe_label_free(intlabel);
 		break;
 
 	default:
@@ -983,7 +982,7 @@ out:
 int
 __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct nameidata nd;
 	struct mount *mp;
 	struct mac mac;
@@ -1005,13 +1004,11 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 		return (error);
 	}
 
-	mac_init_vnode_label(&intlabel);
-	error = mac_internalize_vnode_label(&intlabel, buffer);
+	intlabel = mac_vnode_label_alloc();
+	error = mac_internalize_vnode_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_vnode_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	mtx_lock(&Giant);				/* VFS */
 
@@ -1021,15 +1018,15 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 	if (error == 0) {
 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
 		if (error == 0)
-			error = vn_setlabel(nd.ni_vp, &intlabel,
+			error = vn_setlabel(nd.ni_vp, intlabel,
 			    td->td_ucred);
 		vn_finished_write(mp);
 	}
 
 	NDFREE(&nd, 0);
 	mtx_unlock(&Giant);				/* VFS */
-	mac_destroy_vnode_label(&intlabel);
-
+out:
+	mac_vnode_label_free(intlabel);
 	return (error);
 }
 
@@ -1039,7 +1036,7 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 int
 __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct nameidata nd;
 	struct mount *mp;
 	struct mac mac;
@@ -1061,13 +1058,11 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 		return (error);
 	}
 
-	mac_init_vnode_label(&intlabel);
-	error = mac_internalize_vnode_label(&intlabel, buffer);
+	intlabel = mac_vnode_label_alloc();
+	error = mac_internalize_vnode_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_vnode_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	mtx_lock(&Giant);				/* VFS */
 
@@ -1077,15 +1072,15 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 	if (error == 0) {
 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
 		if (error == 0)
-			error = vn_setlabel(nd.ni_vp, &intlabel,
+			error = vn_setlabel(nd.ni_vp, intlabel,
 			    td->td_ucred);
 		vn_finished_write(mp);
 	}
 
 	NDFREE(&nd, 0);
 	mtx_unlock(&Giant);				/* VFS */
-	mac_destroy_vnode_label(&intlabel);
-
+out:
+	mac_vnode_label_free(intlabel);
 	return (error);
 }
 
diff --git a/sys/security/mac/mac_framework.h b/sys/security/mac/mac_framework.h
index 7955c25aa611..1dc6bf111fae 100644
--- a/sys/security/mac/mac_framework.h
+++ b/sys/security/mac/mac_framework.h
@@ -144,7 +144,6 @@ int	mac_init_mbuf_tag(struct m_tag *, int flag);
 void	mac_init_mount(struct mount *);
 void	mac_init_proc(struct proc *);
 void	mac_init_vnode(struct vnode *);
-void	mac_init_vnode_label(struct label *);
 void	mac_copy_mbuf_tag(struct m_tag *, struct m_tag *);
 void	mac_copy_vnode_label(struct label *, struct label *label);
 void	mac_destroy_bpfdesc(struct bpf_d *);
@@ -158,7 +157,12 @@ void	mac_destroy_proc(struct proc *);
 void	mac_destroy_mbuf_tag(struct m_tag *);
 void	mac_destroy_mount(struct mount *);
 void	mac_destroy_vnode(struct vnode *);
-void	mac_destroy_vnode_label(struct label *);
+
+struct label	*mac_cred_label_alloc(void);
+void		 mac_cred_label_free(struct label *label);
+struct label	*mac_vnode_label_alloc(void);
+void		 mac_vnode_label_free(struct label *label);
+void		 mac_destroy_vnode_label(struct label *);
 
 /*
  * Labeling event operations: file system objects, and things that
@@ -220,8 +224,7 @@ void	mac_update_ipq(struct mbuf *fragment, struct ipq *ipq);
  * Labeling event operations: processes.
  */
 void	mac_create_cred(struct ucred *cred_parent, struct ucred *cred_child);
-int	mac_execve_enter(struct image_params *imgp, struct mac *mac_p,
-	    struct label *execlabel);
+int	mac_execve_enter(struct image_params *imgp, struct mac *mac_p);
 void	mac_execve_exit(struct image_params *imgp);
 void	mac_execve_transition(struct ucred *old, struct ucred *new,
 	    struct vnode *vp, struct label *interpvnodelabel,
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index b07cf6fd32c4..957057bd002f 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -59,6 +59,7 @@ extern struct mac_policy_list_head	mac_policy_list;
 extern struct mac_policy_list_head	mac_static_policy_list;
 extern int				mac_late;
 extern int				mac_enforce_process;
+extern int				mac_enforce_sysv;
 extern int				mac_enforce_vm;
 #ifndef MAC_ALWAYS_LABEL_MBUF
 extern int				mac_labelmbufs;
@@ -88,6 +89,10 @@ void	mac_policy_list_busy(void);
 int	mac_policy_list_conditional_busy(void);
 void	mac_policy_list_unbusy(void);
 
+struct label	*mac_labelzone_alloc(int flags);
+void		 mac_labelzone_free(struct label *label);
+void		 mac_labelzone_init(void);
+
 void	mac_init_label(struct label *label);
 void	mac_destroy_label(struct label *label);
 int	mac_check_structmac_consistent(struct mac *mac);
@@ -98,19 +103,18 @@ int	mac_allocate_slot(void);
  * the namespaces, etc, should work for these, so for now, sort by
  * object type.
  */
+struct label	*mac_pipe_label_alloc(void);
+void		 mac_pipe_label_free(struct label *label);
+
 int	mac_check_cred_relabel(struct ucred *cred, struct label *newlabel);
-void	mac_destroy_cred_label(struct label *label);
-int	mac_externalize_cred_label(struct label *label, char *elements,
+int	mac_externalize_cred_label(struct label *label, char *elements, 
 	    char *outbuf, size_t outbuflen);
-void	mac_init_cred_label(struct label *label);
 int	mac_internalize_cred_label(struct label *label, char *string);
 void	mac_relabel_cred(struct ucred *cred, struct label *newlabel);
 
 void	mac_copy_pipe_label(struct label *src, struct label *dest);
-void	mac_destroy_pipe_label(struct label *label);
 int	mac_externalize_pipe_label(struct label *label, char *elements,
 	    char *outbuf, size_t outbuflen);
-void	mac_init_pipe_label(struct label *label);
 int	mac_internalize_pipe_label(struct label *label, char *string);
 
 int	mac_externalize_vnode_label(struct label *label, char *elements,
diff --git a/sys/security/mac/mac_label.c b/sys/security/mac/mac_label.c
new file mode 100644
index 000000000000..eedc1dfaa3d9
--- /dev/null
+++ b/sys/security/mac/mac_label.c
@@ -0,0 +1,97 @@
+/*-
+ * Copyright (c) 2003 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project in part by Network
+ * Associates Laboratories, the Security Research Division of Network
+ * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"),
+ * as part of the DARPA CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include "opt_mac.h"
+
+#include <sys/param.h>
+#include <sys/mac.h>
+#include <sys/sysctl.h>
+#include <sys/systm.h>
+
+#include <vm/uma.h>
+
+#include <security/mac/mac_internal.h>
+
+uma_zone_t	zone_label;
+
+static void	mac_labelzone_ctor(void *mem, int size, void *arg);
+static void	mac_labelzone_dtor(void *mem, int size, void *arg);
+
+void
+mac_labelzone_init(void)
+{
+
+	zone_label = uma_zcreate("MAC labels", sizeof(struct label),
+	    mac_labelzone_ctor, mac_labelzone_dtor, NULL, NULL,
+	    UMA_ALIGN_PTR, 0);
+}
+
+static void
+mac_labelzone_ctor(void *mem, int size, void *arg)
+{
+	struct label *label;
+
+	KASSERT(size == sizeof(*label), ("mac_labelzone_ctor: wrong size\n"));
+	label = mem;
+	bzero(label, sizeof(*label));
+	label->l_flags = MAC_FLAG_INITIALIZED;
+}
+
+static void
+mac_labelzone_dtor(void *mem, int size, void *arg)
+{
+	struct label *label;
+
+	KASSERT(size == sizeof(*label), ("mac_labelzone_dtor: wrong size\n"));
+	label = mem;
+#ifdef DIAGNOSTIC
+	bzero(label, sizeof(*label));
+#else
+	label->l_flags &= ~MAC_FLAG_INITIALIZED;
+#endif
+}
+
+struct label *
+mac_labelzone_alloc(int flags)
+{
+
+	return (uma_zalloc(zone_label, flags));
+}
+
+void
+mac_labelzone_free(struct label *label)
+{
+
+	uma_zfree(zone_label, label);
+}
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 308231e21192..79503930c0d2 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -91,7 +91,8 @@ SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, sockets, CTLFLAG_RD,
     &nmacsockets, 0, "number of sockets in use");
 #endif
 
-static void	mac_destroy_socket_label(struct label *label);
+static void	mac_socket_label_free(struct label *label);
+
 
 static struct label *
 mbuf_to_label(struct mbuf *mbuf)
@@ -105,46 +106,70 @@ mbuf_to_label(struct mbuf *mbuf)
 	return (label);
 }
 
+static struct label *
+mac_bpfdesc_label_alloc(void)
+{
+	struct label *label;
+
+	label = mac_labelzone_alloc(M_WAITOK);
+	MAC_PERFORM(init_bpfdesc_label, label);
+	MAC_DEBUG_COUNTER_INC(&nmacbpfdescs);
+	return (label);
+}
+
 void
 mac_init_bpfdesc(struct bpf_d *bpf_d)
 {
 
-	mac_init_label(&bpf_d->bd_label);
-	MAC_PERFORM(init_bpfdesc_label, &bpf_d->bd_label);
-	MAC_DEBUG_COUNTER_INC(&nmacbpfdescs);
+	bpf_d->bd_label = mac_bpfdesc_label_alloc();
 }
 
-static void
-mac_init_ifnet_label(struct label *label)
+static struct label *
+mac_ifnet_label_alloc(void)
 {
+	struct label *label;
 
-	mac_init_label(label);
+	label = mac_labelzone_alloc(M_WAITOK);
 	MAC_PERFORM(init_ifnet_label, label);
 	MAC_DEBUG_COUNTER_INC(&nmacifnets);
+	return (label);
 }
 
 void
 mac_init_ifnet(struct ifnet *ifp)
 {
 
-	mac_init_ifnet_label(&ifp->if_label);
+	ifp->if_label = mac_ifnet_label_alloc();
 }
 
-int
-mac_init_ipq(struct ipq *ipq, int flag)
+static struct label *
+mac_ipq_label_alloc(int flag)
 {
+	struct label *label;
 	int error;
 
-	mac_init_label(&ipq->ipq_label);
+	label = mac_labelzone_alloc(flag);
+	if (label == NULL)
+		return (NULL);
 
-	MAC_CHECK(init_ipq_label, &ipq->ipq_label, flag);
+	MAC_CHECK(init_ipq_label, label, flag);
 	if (error) {
-		MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label);
-		mac_destroy_label(&ipq->ipq_label);
-	} else {
-		MAC_DEBUG_COUNTER_INC(&nmacipqs);
+		MAC_PERFORM(destroy_ipq_label, label);
+		mac_labelzone_free(label);
+		return (NULL);
 	}
-	return (error);
+	MAC_DEBUG_COUNTER_INC(&nmacipqs);
+	return (label);
+}
+
+int
+mac_init_ipq(struct ipq *ipq, int flag)
+{
+
+	ipq->ipq_label = mac_ipq_label_alloc(flag);
+	if (ipq->ipq_label == NULL)
+		return (ENOMEM);
+	return (0);
 }
 
 int
@@ -195,71 +220,85 @@ mac_init_mbuf(struct mbuf *m, int flag)
 	return (0);
 }
 
-static int
-mac_init_socket_label(struct label *label, int flag)
+static struct label *
+mac_socket_label_alloc(int flag)
 {
+	struct label *label;
 	int error;
 
-	mac_init_label(label);
+	label = mac_labelzone_alloc(flag);
+	if (label == NULL)
+		return (NULL);
 
 	MAC_CHECK(init_socket_label, label, flag);
 	if (error) {
 		MAC_PERFORM(destroy_socket_label, label);
-		mac_destroy_label(label);
-	} else {
-		MAC_DEBUG_COUNTER_INC(&nmacsockets);
+		mac_labelzone_free(label);
+		return  (NULL);
 	}
-
-	return (error);
+	MAC_DEBUG_COUNTER_INC(&nmacsockets);
+	return (label);
 }
 
-static int
-mac_init_socket_peer_label(struct label *label, int flag)
+static struct label *
+mac_socket_peer_label_alloc(int flag)
 {
+	struct label *label;
 	int error;
 
-	mac_init_label(label);
+	label = mac_labelzone_alloc(flag);
+	if (label == NULL)
+		return (NULL);
 
 	MAC_CHECK(init_socket_peer_label, label, flag);
 	if (error) {
 		MAC_PERFORM(destroy_socket_peer_label, label);
-		mac_destroy_label(label);
+		mac_labelzone_free(label);
+		return  (NULL);
 	}
-
-	return (error);
+	MAC_DEBUG_COUNTER_INC(&nmacsockets);
+	return (label);
 }
 
 int
-mac_init_socket(struct socket *socket, int flag)
+mac_init_socket(struct socket *so, int flag)
 {
-	int error;
 
-	error = mac_init_socket_label(&socket->so_label, flag);
-	if (error)
-		return (error);
+	so->so_label = mac_socket_label_alloc(flag);
+	if (so->so_label == NULL)
+		return (ENOMEM);
+	so->so_peerlabel = mac_socket_peer_label_alloc(flag);
+	if (so->so_peerlabel == NULL) {
+		mac_socket_label_free(so->so_label);
+		so->so_label = NULL;
+		return (ENOMEM);
+	}
+	return (0);
+}
 
-	error = mac_init_socket_peer_label(&socket->so_peerlabel, flag);
-	if (error)
-		mac_destroy_socket_label(&socket->so_label);
+static void
+mac_bpfdesc_label_free(struct label *label)
+{
 
-	return (error);
+	MAC_PERFORM(destroy_bpfdesc_label, label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs);
 }
 
 void
 mac_destroy_bpfdesc(struct bpf_d *bpf_d)
 {
 
-	MAC_PERFORM(destroy_bpfdesc_label, &bpf_d->bd_label);
-	mac_destroy_label(&bpf_d->bd_label);
-	MAC_DEBUG_COUNTER_DEC(&nmacbpfdescs);
+	mac_bpfdesc_label_free(bpf_d->bd_label);
+	bpf_d->bd_label = NULL;
 }
 
 static void
-mac_destroy_ifnet_label(struct label *label)
+mac_ifnet_label_free(struct label *label)
 {
 
 	MAC_PERFORM(destroy_ifnet_label, label);
-	mac_destroy_label(label);
+	mac_labelzone_free(label);
 	MAC_DEBUG_COUNTER_DEC(&nmacifnets);
 }
 
@@ -267,16 +306,25 @@ void
 mac_destroy_ifnet(struct ifnet *ifp)
 {
 
-	mac_destroy_ifnet_label(&ifp->if_label);
+	mac_ifnet_label_free(ifp->if_label);
+	ifp->if_label = NULL;
+}
+
+static void
+mac_ipq_label_free(struct label *label)
+{
+
+	MAC_PERFORM(destroy_ipq_label, label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacipqs);
 }
 
 void
 mac_destroy_ipq(struct ipq *ipq)
 {
 
-	MAC_PERFORM(destroy_ipq_label, &ipq->ipq_label);
-	mac_destroy_label(&ipq->ipq_label);
-	MAC_DEBUG_COUNTER_DEC(&nmacipqs);
+	mac_ipq_label_free(ipq->ipq_label);
+	ipq->ipq_label = NULL;
 }
 
 void
@@ -292,28 +340,31 @@ mac_destroy_mbuf_tag(struct m_tag *tag)
 }
 
 static void
-mac_destroy_socket_label(struct label *label)
+mac_socket_label_free(struct label *label)
 {
 
 	MAC_PERFORM(destroy_socket_label, label);
-	mac_destroy_label(label);
+	mac_labelzone_free(label);
 	MAC_DEBUG_COUNTER_DEC(&nmacsockets);
 }
 
 static void
-mac_destroy_socket_peer_label(struct label *label)
+mac_socket_peer_label_free(struct label *label)
 {
 
 	MAC_PERFORM(destroy_socket_peer_label, label);
-	mac_destroy_label(label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacsockets);
 }
 
 void
 mac_destroy_socket(struct socket *socket)
 {
 
-	mac_destroy_socket_label(&socket->so_label);
-	mac_destroy_socket_peer_label(&socket->so_peerlabel);
+	mac_socket_label_free(socket->so_label);
+	socket->so_label = NULL;
+	mac_socket_peer_label_free(socket->so_peerlabel);
+	socket->so_peerlabel = NULL;
 }
 
 void
@@ -388,21 +439,21 @@ void
 mac_create_ifnet(struct ifnet *ifnet)
 {
 
-	MAC_PERFORM(create_ifnet, ifnet, &ifnet->if_label);
+	MAC_PERFORM(create_ifnet, ifnet, ifnet->if_label);
 }
 
 void
 mac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d)
 {
 
-	MAC_PERFORM(create_bpfdesc, cred, bpf_d, &bpf_d->bd_label);
+	MAC_PERFORM(create_bpfdesc, cred, bpf_d, bpf_d->bd_label);
 }
 
 void
 mac_create_socket(struct ucred *cred, struct socket *socket)
 {
 
-	MAC_PERFORM(create_socket, cred, socket, &socket->so_label);
+	MAC_PERFORM(create_socket, cred, socket, socket->so_label);
 }
 
 void
@@ -410,8 +461,8 @@ mac_create_socket_from_socket(struct socket *oldsocket,
     struct socket *newsocket)
 {
 
-	MAC_PERFORM(create_socket_from_socket, oldsocket, &oldsocket->so_label,
-	    newsocket, &newsocket->so_label);
+	MAC_PERFORM(create_socket_from_socket, oldsocket, oldsocket->so_label,
+	    newsocket, newsocket->so_label);
 }
 
 static void
@@ -419,7 +470,7 @@ mac_relabel_socket(struct ucred *cred, struct socket *socket,
     struct label *newlabel)
 {
 
-	MAC_PERFORM(relabel_socket, cred, socket, &socket->so_label, newlabel);
+	MAC_PERFORM(relabel_socket, cred, socket, socket->so_label, newlabel);
 }
 
 void
@@ -430,7 +481,7 @@ mac_set_socket_peer_from_mbuf(struct mbuf *mbuf, struct socket *socket)
 	label = mbuf_to_label(mbuf);
 
 	MAC_PERFORM(set_socket_peer_from_mbuf, mbuf, label, socket,
-	    &socket->so_peerlabel);
+	    socket->so_peerlabel);
 }
 
 void
@@ -439,7 +490,7 @@ mac_set_socket_peer_from_socket(struct socket *oldsocket,
 {
 
 	MAC_PERFORM(set_socket_peer_from_socket, oldsocket,
-	    &oldsocket->so_label, newsocket, &newsocket->so_peerlabel);
+	    oldsocket->so_label, newsocket, newsocket->so_peerlabel);
 }
 
 void
@@ -449,7 +500,7 @@ mac_create_datagram_from_ipq(struct ipq *ipq, struct mbuf *datagram)
 
 	label = mbuf_to_label(datagram);
 
-	MAC_PERFORM(create_datagram_from_ipq, ipq, &ipq->ipq_label,
+	MAC_PERFORM(create_datagram_from_ipq, ipq, ipq->ipq_label,
 	    datagram, label);
 }
 
@@ -472,7 +523,7 @@ mac_create_ipq(struct mbuf *fragment, struct ipq *ipq)
 
 	label = mbuf_to_label(fragment);
 
-	MAC_PERFORM(create_ipq, fragment, label, ipq, &ipq->ipq_label);
+	MAC_PERFORM(create_ipq, fragment, label, ipq, ipq->ipq_label);
 }
 
 void
@@ -494,7 +545,7 @@ mac_create_mbuf_from_bpfdesc(struct bpf_d *bpf_d, struct mbuf *mbuf)
 
 	label = mbuf_to_label(mbuf);
 
-	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, &bpf_d->bd_label, mbuf,
+	MAC_PERFORM(create_mbuf_from_bpfdesc, bpf_d, bpf_d->bd_label, mbuf,
 	    label);
 }
 
@@ -505,7 +556,7 @@ mac_create_mbuf_linklayer(struct ifnet *ifnet, struct mbuf *mbuf)
 
 	label = mbuf_to_label(mbuf);
 
-	MAC_PERFORM(create_mbuf_linklayer, ifnet, &ifnet->if_label, mbuf,
+	MAC_PERFORM(create_mbuf_linklayer, ifnet, ifnet->if_label, mbuf,
 	    label);
 }
 
@@ -516,7 +567,7 @@ mac_create_mbuf_from_ifnet(struct ifnet *ifnet, struct mbuf *mbuf)
 
 	label = mbuf_to_label(mbuf);
 
-	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, &ifnet->if_label, mbuf,
+	MAC_PERFORM(create_mbuf_from_ifnet, ifnet, ifnet->if_label, mbuf,
 	    label);
 }
 
@@ -530,7 +581,7 @@ mac_create_mbuf_multicast_encap(struct mbuf *oldmbuf, struct ifnet *ifnet,
 	newmbuflabel = mbuf_to_label(newmbuf);
 
 	MAC_PERFORM(create_mbuf_multicast_encap, oldmbuf, oldmbuflabel,
-	    ifnet, &ifnet->if_label, newmbuf, newmbuflabel);
+	    ifnet, ifnet->if_label, newmbuf, newmbuflabel);
 }
 
 void
@@ -555,7 +606,7 @@ mac_fragment_match(struct mbuf *fragment, struct ipq *ipq)
 
 	result = 1;
 	MAC_BOOLEAN(fragment_match, &&, fragment, label, ipq,
-	    &ipq->ipq_label);
+	    ipq->ipq_label);
 
 	return (result);
 }
@@ -586,7 +637,7 @@ mac_update_ipq(struct mbuf *fragment, struct ipq *ipq)
 
 	label = mbuf_to_label(fragment);
 
-	MAC_PERFORM(update_ipq, fragment, label, ipq, &ipq->ipq_label);
+	MAC_PERFORM(update_ipq, fragment, label, ipq, ipq->ipq_label);
 }
 
 void
@@ -596,7 +647,7 @@ mac_create_mbuf_from_socket(struct socket *socket, struct mbuf *mbuf)
 
 	label = mbuf_to_label(mbuf);
 
-	MAC_PERFORM(create_mbuf_from_socket, socket, &socket->so_label, mbuf,
+	MAC_PERFORM(create_mbuf_from_socket, socket, socket->so_label, mbuf,
 	    label);
 }
 
@@ -608,8 +659,8 @@ mac_check_bpfdesc_receive(struct bpf_d *bpf_d, struct ifnet *ifnet)
 	if (!mac_enforce_network)
 		return (0);
 
-	MAC_CHECK(check_bpfdesc_receive, bpf_d, &bpf_d->bd_label, ifnet,
-	    &ifnet->if_label);
+	MAC_CHECK(check_bpfdesc_receive, bpf_d, bpf_d->bd_label, ifnet,
+	    ifnet->if_label);
 
 	return (error);
 }
@@ -627,7 +678,7 @@ mac_check_ifnet_transmit(struct ifnet *ifnet, struct mbuf *mbuf)
 
 	label = mbuf_to_label(mbuf);
 
-	MAC_CHECK(check_ifnet_transmit, ifnet, &ifnet->if_label, mbuf,
+	MAC_CHECK(check_ifnet_transmit, ifnet, ifnet->if_label, mbuf,
 	    label);
 
 	return (error);
@@ -642,7 +693,7 @@ mac_check_socket_bind(struct ucred *ucred, struct socket *socket,
 	if (!mac_enforce_socket)
 		return (0);
 
-	MAC_CHECK(check_socket_bind, ucred, socket, &socket->so_label,
+	MAC_CHECK(check_socket_bind, ucred, socket, socket->so_label,
 	    sockaddr);
 
 	return (error);
@@ -657,7 +708,7 @@ mac_check_socket_connect(struct ucred *cred, struct socket *socket,
 	if (!mac_enforce_socket)
 		return (0);
 
-	MAC_CHECK(check_socket_connect, cred, socket, &socket->so_label,
+	MAC_CHECK(check_socket_connect, cred, socket, socket->so_label,
 	    sockaddr);
 
 	return (error);
@@ -674,7 +725,7 @@ mac_check_socket_deliver(struct socket *socket, struct mbuf *mbuf)
 
 	label = mbuf_to_label(mbuf);
 
-	MAC_CHECK(check_socket_deliver, socket, &socket->so_label, mbuf,
+	MAC_CHECK(check_socket_deliver, socket, socket->so_label, mbuf,
 	    label);
 
 	return (error);
@@ -688,7 +739,7 @@ mac_check_socket_listen(struct ucred *cred, struct socket *socket)
 	if (!mac_enforce_socket)
 		return (0);
 
-	MAC_CHECK(check_socket_listen, cred, socket, &socket->so_label);
+	MAC_CHECK(check_socket_listen, cred, socket, socket->so_label);
 	return (error);
 }
 
@@ -700,7 +751,7 @@ mac_check_socket_receive(struct ucred *cred, struct socket *so)
 	if (!mac_enforce_socket)
 		return (0);
 
-	MAC_CHECK(check_socket_receive, cred, so, &so->so_label);
+	MAC_CHECK(check_socket_receive, cred, so, so->so_label);
 
 	return (error);
 }
@@ -711,7 +762,7 @@ mac_check_socket_relabel(struct ucred *cred, struct socket *socket,
 {
 	int error;
 
-	MAC_CHECK(check_socket_relabel, cred, socket, &socket->so_label,
+	MAC_CHECK(check_socket_relabel, cred, socket, socket->so_label,
 	    newlabel);
 
 	return (error);
@@ -725,7 +776,7 @@ mac_check_socket_send(struct ucred *cred, struct socket *so)
 	if (!mac_enforce_socket)
 		return (0);
 
-	MAC_CHECK(check_socket_send, cred, so, &so->so_label);
+	MAC_CHECK(check_socket_send, cred, so, so->so_label);
 
 	return (error);
 }
@@ -738,7 +789,7 @@ mac_check_socket_visible(struct ucred *cred, struct socket *socket)
 	if (!mac_enforce_socket)
 		return (0);
 
-	MAC_CHECK(check_socket_visible, cred, socket, &socket->so_label);
+	MAC_CHECK(check_socket_visible, cred, socket, socket->so_label);
 
 	return (error);
 }
@@ -767,7 +818,7 @@ mac_ioctl_ifnet_get(struct ucred *cred, struct ifreq *ifr,
 	}
 
 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_ifnet_label(&ifnet->if_label, elements,
+	error = mac_externalize_ifnet_label(ifnet->if_label, elements,
 	    buffer, mac.m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -782,7 +833,7 @@ int
 mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
     struct ifnet *ifnet)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct mac mac;
 	char *buffer;
 	int error;
@@ -802,11 +853,11 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 		return (error);
 	}
 
-	mac_init_ifnet_label(&intlabel);
-	error = mac_internalize_ifnet_label(&intlabel, buffer);
+	intlabel = mac_ifnet_label_alloc();
+	error = mac_internalize_ifnet_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
 	if (error) {
-		mac_destroy_ifnet_label(&intlabel);
+		mac_ifnet_label_free(intlabel);
 		return (error);
 	}
 
@@ -817,20 +868,20 @@ mac_ioctl_ifnet_set(struct ucred *cred, struct ifreq *ifr,
 	 */
 	error = suser_cred(cred, 0);
 	if (error) {
-		mac_destroy_ifnet_label(&intlabel);
+		mac_ifnet_label_free(intlabel);
 		return (error);
 	}
 
-	MAC_CHECK(check_ifnet_relabel, cred, ifnet, &ifnet->if_label,
-	    &intlabel);
+	MAC_CHECK(check_ifnet_relabel, cred, ifnet, ifnet->if_label,
+	    intlabel);
 	if (error) {
-		mac_destroy_ifnet_label(&intlabel);
+		mac_ifnet_label_free(intlabel);
 		return (error);
 	}
 
-	MAC_PERFORM(relabel_ifnet, cred, ifnet, &ifnet->if_label, &intlabel);
+	MAC_PERFORM(relabel_ifnet, cred, ifnet, ifnet->if_label, intlabel);
 
-	mac_destroy_ifnet_label(&intlabel);
+	mac_ifnet_label_free(intlabel);
 	return (0);
 }
 
@@ -838,7 +889,7 @@ int
 mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
     struct mac *mac)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	char *buffer;
 	int error;
 
@@ -853,23 +904,23 @@ mac_setsockopt_label_set(struct ucred *cred, struct socket *so,
 		return (error);
 	}
 
-	mac_init_socket_label(&intlabel, M_WAITOK);
-	error = mac_internalize_socket_label(&intlabel, buffer);
+	intlabel = mac_socket_label_alloc(M_WAITOK);
+	error = mac_internalize_socket_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
 	if (error) {
-		mac_destroy_socket_label(&intlabel);
+		mac_socket_label_free(intlabel);
 		return (error);
 	}
 
-	mac_check_socket_relabel(cred, so, &intlabel);
+	mac_check_socket_relabel(cred, so, intlabel);
 	if (error) {
-		mac_destroy_socket_label(&intlabel);
+		mac_socket_label_free(intlabel);
 		return (error);
 	}
 
-	mac_relabel_socket(cred, so, &intlabel);
+	mac_relabel_socket(cred, so, intlabel);
 
-	mac_destroy_socket_label(&intlabel);
+	mac_socket_label_free(intlabel);
 	return (0);
 }
 
@@ -892,7 +943,7 @@ mac_getsockopt_label_get(struct ucred *cred, struct socket *so,
 	}
 
 	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_socket_label(&so->so_label, elements,
+	error = mac_externalize_socket_label(so->so_label, elements,
 	    buffer, mac->m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac->m_string, strlen(buffer)+1);
@@ -922,7 +973,7 @@ mac_getsockopt_peerlabel_get(struct ucred *cred, struct socket *so,
 	}
 
 	buffer = malloc(mac->m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_socket_peer_label(&so->so_peerlabel,
+	error = mac_externalize_socket_peer_label(so->so_peerlabel,
 	    elements, buffer, mac->m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac->m_string, strlen(buffer)+1);
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index b30ebaf5385b..61633c3bebc4 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -61,34 +61,31 @@ SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, pipes, CTLFLAG_RD,
     &nmacpipes, 0, "number of pipes in use");
 #endif
 
-MALLOC_DEFINE(M_MACPIPELABEL, "macpipelabel", "MAC labels for pipes");
-
-void
-mac_init_pipe_label(struct label *label)
+struct label *
+mac_pipe_label_alloc(void)
 {
+	struct label *label;
 
-	mac_init_label(label);
+	label = mac_labelzone_alloc(M_WAITOK);
 	MAC_PERFORM(init_pipe_label, label);
 	MAC_DEBUG_COUNTER_INC(&nmacpipes);
+	return (label);
 }
 
 void
 mac_init_pipe(struct pipe *pipe)
 {
-	struct label *label;
 
-	label = malloc(sizeof(struct label), M_MACPIPELABEL, M_ZERO|M_WAITOK);
-	pipe->pipe_label = label;
-	pipe->pipe_peer->pipe_label = label;
-	mac_init_pipe_label(label);
+	pipe->pipe_label = pipe->pipe_peer->pipe_label =
+	    mac_pipe_label_alloc();
 }
 
 void
-mac_destroy_pipe_label(struct label *label)
+mac_pipe_label_free(struct label *label)
 {
 
 	MAC_PERFORM(destroy_pipe_label, label);
-	mac_destroy_label(label);
+	mac_labelzone_free(label);
 	MAC_DEBUG_COUNTER_DEC(&nmacpipes);
 }
 
@@ -96,8 +93,8 @@ void
 mac_destroy_pipe(struct pipe *pipe)
 {
 
-	mac_destroy_pipe_label(pipe->pipe_label);
-	free(pipe->pipe_label, M_MACPIPELABEL);
+	mac_pipe_label_free(pipe->pipe_label);
+	pipe->pipe_label = NULL;
 }
 
 void
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 769767121036..68d847dcfb4e 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -96,37 +96,48 @@ SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, procs, CTLFLAG_RD,
 static void	mac_cred_mmapped_drop_perms_recurse(struct thread *td,
 		    struct ucred *cred, struct vm_map *map);
 
-void
-mac_init_cred_label(struct label *label)
+struct label *
+mac_cred_label_alloc(void)
 {
+	struct label *label;
 
-	mac_init_label(label);
+	label = mac_labelzone_alloc(M_WAITOK);
 	MAC_PERFORM(init_cred_label, label);
 	MAC_DEBUG_COUNTER_INC(&nmaccreds);
+	return (label);
 }
 
 void
 mac_init_cred(struct ucred *cred)
 {
 
-	mac_init_cred_label(&cred->cr_label);
+	cred->cr_label = mac_cred_label_alloc();
+}
+
+static struct label *
+mac_proc_label_alloc(void)
+{
+	struct label *label;
+
+	label = mac_labelzone_alloc(M_WAITOK);
+	MAC_PERFORM(init_proc_label, label);
+	MAC_DEBUG_COUNTER_INC(&nmacprocs);
+	return (label);
 }
 
 void
 mac_init_proc(struct proc *p)
 {
 
-	mac_init_label(&p->p_label);
-	MAC_PERFORM(init_proc_label, &p->p_label);
-	MAC_DEBUG_COUNTER_INC(&nmacprocs);
+	p->p_label = mac_proc_label_alloc();
 }
 
 void
-mac_destroy_cred_label(struct label *label)
+mac_cred_label_free(struct label *label)
 {
 
 	MAC_PERFORM(destroy_cred_label, label);
-	mac_destroy_label(label);
+	mac_labelzone_free(label);
 	MAC_DEBUG_COUNTER_DEC(&nmaccreds);
 }
 
@@ -134,16 +145,25 @@ void
 mac_destroy_cred(struct ucred *cred)
 {
 
-	mac_destroy_cred_label(&cred->cr_label);
+	mac_cred_label_free(cred->cr_label);
+	cred->cr_label = NULL;
+}
+
+static void
+mac_proc_label_free(struct label *label)
+{
+
+	MAC_PERFORM(destroy_proc_label, label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacprocs);
 }
 
 void
 mac_destroy_proc(struct proc *p)
 {
 
-	MAC_PERFORM(destroy_proc_label, &p->p_label);
-	mac_destroy_label(&p->p_label);
-	MAC_DEBUG_COUNTER_DEC(&nmacprocs);
+	mac_proc_label_free(p->p_label);
+	p->p_label = NULL;
 }
 
 int
@@ -209,9 +229,9 @@ mac_create_cred(struct ucred *parent_cred, struct ucred *child_cred)
 }
 
 int
-mac_execve_enter(struct image_params *imgp, struct mac *mac_p,
-    struct label *execlabelstorage)
+mac_execve_enter(struct image_params *imgp, struct mac *mac_p)
 {
+	struct label *label;
 	struct mac mac;
 	char *buffer;
 	int error;
@@ -234,22 +254,24 @@ mac_execve_enter(struct image_params *imgp, struct mac *mac_p,
 		return (error);
 	}
 
-	mac_init_cred_label(execlabelstorage);
-	error = mac_internalize_cred_label(execlabelstorage, buffer);
+	label = mac_cred_label_alloc();
+	error = mac_internalize_cred_label(label, buffer);
 	free(buffer, M_MACTEMP);
 	if (error) {
-		mac_destroy_cred_label(execlabelstorage);
+		mac_cred_label_free(label);
 		return (error);
 	}
-	imgp->execlabel = execlabelstorage;
+	imgp->execlabel = label;
 	return (0);
 }
 
 void
 mac_execve_exit(struct image_params *imgp)
 {
-	if (imgp->execlabel != NULL)
-		mac_destroy_cred_label(imgp->execlabel);
+	if (imgp->execlabel != NULL) {
+		mac_cred_label_free(imgp->execlabel);
+		imgp->execlabel = NULL;
+	}
 }
 
 /*
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index c45900379dcb..f9adf9bee8d0 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -256,6 +256,7 @@ mac_init(void)
 
 	LIST_INIT(&mac_static_policy_list);
 	LIST_INIT(&mac_policy_list);
+	mac_labelzone_init();
 
 	mtx_init(&mac_policy_mtx, "mac_policy_mtx", NULL, MTX_DEF);
 	cv_init(&mac_policy_cv, "mac_policy_cv");
@@ -565,7 +566,7 @@ __mac_get_pid(struct thread *td, struct __mac_get_pid_args *uap)
 	}
 
 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_cred_label(&tcred->cr_label, elements,
+	error = mac_externalize_cred_label(tcred->cr_label, elements,
 	    buffer, mac.m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -602,7 +603,7 @@ __mac_get_proc(struct thread *td, struct __mac_get_proc_args *uap)
 	}
 
 	buffer = malloc(mac.m_buflen, M_MACTEMP, M_WAITOK | M_ZERO);
-	error = mac_externalize_cred_label(&td->td_ucred->cr_label,
+	error = mac_externalize_cred_label(td->td_ucred->cr_label,
 	    elements, buffer, mac.m_buflen);
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -619,7 +620,7 @@ int
 __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 {
 	struct ucred *newcred, *oldcred;
-	struct label intlabel;
+	struct label *intlabel;
 	struct proc *p;
 	struct mac mac;
 	char *buffer;
@@ -640,13 +641,11 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 		return (error);
 	}
 
-	mac_init_cred_label(&intlabel);
-	error = mac_internalize_cred_label(&intlabel, buffer);
+	intlabel = mac_cred_label_alloc();
+	error = mac_internalize_cred_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_cred_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	newcred = crget();
 
@@ -654,7 +653,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 	PROC_LOCK(p);
 	oldcred = p->p_ucred;
 
-	error = mac_check_cred_relabel(oldcred, &intlabel);
+	error = mac_check_cred_relabel(oldcred, intlabel);
 	if (error) {
 		PROC_UNLOCK(p);
 		crfree(newcred);
@@ -663,7 +662,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 
 	setsugid(p);
 	crcopy(newcred, oldcred);
-	mac_relabel_cred(newcred, &intlabel);
+	mac_relabel_cred(newcred, intlabel);
 	p->p_ucred = newcred;
 
 	/*
@@ -683,7 +682,7 @@ __mac_set_proc(struct thread *td, struct __mac_set_proc_args *uap)
 	crfree(oldcred);
 
 out:
-	mac_destroy_cred_label(&intlabel);
+	mac_cred_label_free(intlabel);
 	return (error);
 }
 
@@ -694,7 +693,7 @@ int
 __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 {
 	char *elements, *buffer;
-	struct label intlabel;
+	struct label *intlabel;
 	struct file *fp;
 	struct mac mac;
 	struct vnode *vp;
@@ -729,20 +728,20 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 	case DTYPE_VNODE:
 		vp = fp->f_vnode;
 
-		mac_init_vnode_label(&intlabel);
+		intlabel = mac_vnode_label_alloc();
 
 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-		mac_copy_vnode_label(&vp->v_label, &intlabel);
+		mac_copy_vnode_label(vp->v_label, intlabel);
 		VOP_UNLOCK(vp, 0, td);
 
 		break;
 	case DTYPE_PIPE:
 		pipe = fp->f_data;
 
-		mac_init_pipe_label(&intlabel);
+		intlabel = mac_pipe_label_alloc();
 
 		PIPE_LOCK(pipe);
-		mac_copy_pipe_label(pipe->pipe_label, &intlabel);
+		mac_copy_pipe_label(pipe->pipe_label, intlabel);
 		PIPE_UNLOCK(pipe);
 		break;
 	default:
@@ -756,14 +755,14 @@ __mac_get_fd(struct thread *td, struct __mac_get_fd_args *uap)
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
 		if (error == 0)
-			error = mac_externalize_vnode_label(&intlabel,
+			error = mac_externalize_vnode_label(intlabel,
 			    elements, buffer, mac.m_buflen);
-		mac_destroy_vnode_label(&intlabel);
+		mac_vnode_label_free(intlabel);
 		break;
 	case DTYPE_PIPE:
-		error = mac_externalize_pipe_label(&intlabel, elements,
+		error = mac_externalize_pipe_label(intlabel, elements,
 		    buffer, mac.m_buflen);
-		mac_destroy_pipe_label(&intlabel);
+		mac_pipe_label_free(intlabel);
 		break;
 	default:
 		panic("__mac_get_fd: corrupted label_type");
@@ -788,7 +787,7 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
 {
 	char *elements, *buffer;
 	struct nameidata nd;
-	struct label intlabel;
+	struct label *intlabel;
 	struct mac mac;
 	int error;
 
@@ -815,13 +814,13 @@ __mac_get_file(struct thread *td, struct __mac_get_file_args *uap)
 	if (error)
 		goto out;
 
-	mac_init_vnode_label(&intlabel);
-	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
-	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
+	intlabel = mac_vnode_label_alloc();
+	mac_copy_vnode_label(nd.ni_vp->v_label, intlabel);
+	error = mac_externalize_vnode_label(intlabel, elements, buffer,
 	    mac.m_buflen);
 
 	NDFREE(&nd, 0);
-	mac_destroy_vnode_label(&intlabel);
+	mac_vnode_label_free(intlabel);
 
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -843,7 +842,7 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
 {
 	char *elements, *buffer;
 	struct nameidata nd;
-	struct label intlabel;
+	struct label *intlabel;
 	struct mac mac;
 	int error;
 
@@ -870,12 +869,12 @@ __mac_get_link(struct thread *td, struct __mac_get_link_args *uap)
 	if (error)
 		goto out;
 
-	mac_init_vnode_label(&intlabel);
-	mac_copy_vnode_label(&nd.ni_vp->v_label, &intlabel);
-	error = mac_externalize_vnode_label(&intlabel, elements, buffer,
+	intlabel = mac_vnode_label_alloc();
+	mac_copy_vnode_label(nd.ni_vp->v_label, intlabel);
+	error = mac_externalize_vnode_label(intlabel, elements, buffer,
 	    mac.m_buflen);
 	NDFREE(&nd, 0);
-	mac_destroy_vnode_label(&intlabel);
+	mac_vnode_label_free(intlabel);
 
 	if (error == 0)
 		error = copyout(buffer, mac.m_string, strlen(buffer)+1);
@@ -895,7 +894,7 @@ out:
 int
 __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct pipe *pipe;
 	struct file *fp;
 	struct mount *mp;
@@ -928,40 +927,40 @@ __mac_set_fd(struct thread *td, struct __mac_set_fd_args *uap)
 	switch (fp->f_type) {
 	case DTYPE_FIFO:
 	case DTYPE_VNODE:
-		mac_init_vnode_label(&intlabel);
-		error = mac_internalize_vnode_label(&intlabel, buffer);
+		intlabel = mac_vnode_label_alloc();
+		error = mac_internalize_vnode_label(intlabel, buffer);
 		if (error) {
-			mac_destroy_vnode_label(&intlabel);
+			mac_vnode_label_free(intlabel);
 			break;
 		}
 
 		vp = fp->f_vnode;
 		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
 		if (error != 0) {
-			mac_destroy_vnode_label(&intlabel);
+			mac_vnode_label_free(intlabel);
 			break;
 		}
 
 		vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td);
-		error = vn_setlabel(vp, &intlabel, td->td_ucred);
+		error = vn_setlabel(vp, intlabel, td->td_ucred);
 		VOP_UNLOCK(vp, 0, td);
 		vn_finished_write(mp);
 
-		mac_destroy_vnode_label(&intlabel);
+		mac_vnode_label_free(intlabel);
 		break;
 
 	case DTYPE_PIPE:
-		mac_init_pipe_label(&intlabel);
-		error = mac_internalize_pipe_label(&intlabel, buffer);
+		intlabel = mac_pipe_label_alloc();
+		error = mac_internalize_pipe_label(intlabel, buffer);
 		if (error == 0) {
 			pipe = fp->f_data;
 			PIPE_LOCK(pipe);
 			error = mac_pipe_label_set(td->td_ucred, pipe,
-			    &intlabel);
+			    intlabel);
 			PIPE_UNLOCK(pipe);
 		}
 
-		mac_destroy_pipe_label(&intlabel);
+		mac_pipe_label_free(intlabel);
 		break;
 
 	default:
@@ -983,7 +982,7 @@ out:
 int
 __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct nameidata nd;
 	struct mount *mp;
 	struct mac mac;
@@ -1005,13 +1004,11 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 		return (error);
 	}
 
-	mac_init_vnode_label(&intlabel);
-	error = mac_internalize_vnode_label(&intlabel, buffer);
+	intlabel = mac_vnode_label_alloc();
+	error = mac_internalize_vnode_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_vnode_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	mtx_lock(&Giant);				/* VFS */
 
@@ -1021,15 +1018,15 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 	if (error == 0) {
 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
 		if (error == 0)
-			error = vn_setlabel(nd.ni_vp, &intlabel,
+			error = vn_setlabel(nd.ni_vp, intlabel,
 			    td->td_ucred);
 		vn_finished_write(mp);
 	}
 
 	NDFREE(&nd, 0);
 	mtx_unlock(&Giant);				/* VFS */
-	mac_destroy_vnode_label(&intlabel);
-
+out:
+	mac_vnode_label_free(intlabel);
 	return (error);
 }
 
@@ -1039,7 +1036,7 @@ __mac_set_file(struct thread *td, struct __mac_set_file_args *uap)
 int
 __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 {
-	struct label intlabel;
+	struct label *intlabel;
 	struct nameidata nd;
 	struct mount *mp;
 	struct mac mac;
@@ -1061,13 +1058,11 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 		return (error);
 	}
 
-	mac_init_vnode_label(&intlabel);
-	error = mac_internalize_vnode_label(&intlabel, buffer);
+	intlabel = mac_vnode_label_alloc();
+	error = mac_internalize_vnode_label(intlabel, buffer);
 	free(buffer, M_MACTEMP);
-	if (error) {
-		mac_destroy_vnode_label(&intlabel);
-		return (error);
-	}
+	if (error)
+		goto out;
 
 	mtx_lock(&Giant);				/* VFS */
 
@@ -1077,15 +1072,15 @@ __mac_set_link(struct thread *td, struct __mac_set_link_args *uap)
 	if (error == 0) {
 		error = vn_start_write(nd.ni_vp, &mp, V_WAIT | PCATCH);
 		if (error == 0)
-			error = vn_setlabel(nd.ni_vp, &intlabel,
+			error = vn_setlabel(nd.ni_vp, intlabel,
 			    td->td_ucred);
 		vn_finished_write(mp);
 	}
 
 	NDFREE(&nd, 0);
 	mtx_unlock(&Giant);				/* VFS */
-	mac_destroy_vnode_label(&intlabel);
-
+out:
+	mac_vnode_label_free(intlabel);
 	return (error);
 }
 
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index e5041a29e1eb..14755cf4b388 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -120,7 +120,7 @@ mac_check_kld_load(struct ucred *cred, struct vnode *vp)
 	if (!mac_enforce_kld)
 		return (0);
 
-	MAC_CHECK(check_kld_load, cred, vp, &vp->v_label);
+	MAC_CHECK(check_kld_load, cred, vp, vp->v_label);
 
 	return (error);
 }
@@ -176,7 +176,7 @@ mac_check_system_acct(struct ucred *cred, struct vnode *vp)
 		return (0);
 
 	MAC_CHECK(check_system_acct, cred, vp,
-	    vp != NULL ? &vp->v_label : NULL);
+	    vp != NULL ? vp->v_label : NULL);
 
 	return (error);
 }
@@ -230,7 +230,7 @@ mac_check_system_swapon(struct ucred *cred, struct vnode *vp)
 	if (!mac_enforce_system)
 		return (0);
 
-	MAC_CHECK(check_system_swapon, cred, vp, &vp->v_label);
+	MAC_CHECK(check_system_swapon, cred, vp, vp->v_label);
 	return (error);
 }
 
@@ -244,7 +244,7 @@ mac_check_system_swapoff(struct ucred *cred, struct vnode *vp)
 	if (!mac_enforce_system)
 		return (0);
 
-	MAC_CHECK(check_system_swapoff, cred, vp, &vp->v_label);
+	MAC_CHECK(check_system_swapoff, cred, vp, vp->v_label);
 	return (error);
 }
 
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 08e78bb98dfd..8d475a538ad9 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -100,68 +100,123 @@ SYSCTL_UINT(_security_mac_debug_counters, OID_AUTO, devfsdirents, CTLFLAG_RD,
 static int	mac_setlabel_vnode_extattr(struct ucred *cred,
 		    struct vnode *vp, struct label *intlabel);
 
-void
-mac_init_devfsdirent(struct devfs_dirent *de)
+static struct label *
+mac_devfsdirent_label_alloc(void)
 {
+	struct label *label;
 
-	mac_init_label(&de->de_label);
-	MAC_PERFORM(init_devfsdirent_label, &de->de_label);
+	label = mac_labelzone_alloc(M_WAITOK);
+	MAC_PERFORM(init_devfsdirent_label, label);
 	MAC_DEBUG_COUNTER_INC(&nmacdevfsdirents);
+	return (label);
 }
 
 void
-mac_init_mount(struct mount *mp)
+mac_init_devfsdirent(struct devfs_dirent *de)
+{
+
+	de->de_label = mac_devfsdirent_label_alloc();
+}
+
+static struct label *
+mac_mount_label_alloc(void)
+{
+	struct label *label;
+
+	label = mac_labelzone_alloc(M_WAITOK);
+	MAC_PERFORM(init_mount_label, label);
+	MAC_DEBUG_COUNTER_INC(&nmacmounts);
+	return (label);
+}
+
+static struct label *
+mac_mount_fs_label_alloc(void)
 {
+	struct label *label;
 
-	mac_init_label(&mp->mnt_mntlabel);
-	mac_init_label(&mp->mnt_fslabel);
-	MAC_PERFORM(init_mount_label, &mp->mnt_mntlabel);
-	MAC_PERFORM(init_mount_fs_label, &mp->mnt_fslabel);
+	label = mac_labelzone_alloc(M_WAITOK);
+	MAC_PERFORM(init_mount_fs_label, label);
 	MAC_DEBUG_COUNTER_INC(&nmacmounts);
+	return (label);
 }
 
 void
-mac_init_vnode_label(struct label *label)
+mac_init_mount(struct mount *mp)
+{
+
+	mp->mnt_mntlabel = mac_mount_label_alloc();
+	mp->mnt_fslabel = mac_mount_fs_label_alloc();
+}
+
+struct label *
+mac_vnode_label_alloc(void)
 {
+	struct label *label;
 
-	mac_init_label(label);
+	label = mac_labelzone_alloc(M_WAITOK);
 	MAC_PERFORM(init_vnode_label, label);
 	MAC_DEBUG_COUNTER_INC(&nmacvnodes);
+	return (label);
 }
 
 void
 mac_init_vnode(struct vnode *vp)
 {
 
-	mac_init_vnode_label(&vp->v_label);
+	vp->v_label = mac_vnode_label_alloc();
+}
+
+static void
+mac_devfsdirent_label_free(struct label *label)
+{
+
+	MAC_PERFORM(destroy_devfsdirent_label, label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacdevfsdirents);
 }
 
 void
 mac_destroy_devfsdirent(struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(destroy_devfsdirent_label, &de->de_label);
-	mac_destroy_label(&de->de_label);
-	MAC_DEBUG_COUNTER_DEC(&nmacdevfsdirents);
+	mac_devfsdirent_label_free(de->de_label);
+	de->de_label = NULL;
+}
+
+static void
+mac_mount_label_free(struct label *label)
+{
+
+	MAC_PERFORM(destroy_mount_label, label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacmounts);
+}
+
+static void
+mac_mount_fs_label_free(struct label *label)
+{
+
+	MAC_PERFORM(destroy_mount_fs_label, label);
+	mac_labelzone_free(label);
+	MAC_DEBUG_COUNTER_DEC(&nmacmounts);
 }
 
 void
 mac_destroy_mount(struct mount *mp)
 {
 
-	MAC_PERFORM(destroy_mount_label, &mp->mnt_mntlabel);
-	MAC_PERFORM(destroy_mount_fs_label, &mp->mnt_fslabel);
-	mac_destroy_label(&mp->mnt_fslabel);
-	mac_destroy_label(&mp->mnt_mntlabel);
-	MAC_DEBUG_COUNTER_DEC(&nmacmounts);
+	mac_mount_fs_label_free(mp->mnt_fslabel);
+	mp->mnt_fslabel = NULL;
+	mac_mount_label_free(mp->mnt_mntlabel);
+	mp->mnt_mntlabel = NULL;
 }
 
 void
-mac_destroy_vnode_label(struct label *label)
+mac_vnode_label_free(struct label *label)
 {
 
 	MAC_PERFORM(destroy_vnode_label, label);
-	mac_destroy_label(label);
+	mac_labelzone_free(label);
 	MAC_DEBUG_COUNTER_DEC(&nmacvnodes);
 }
 
@@ -169,7 +224,8 @@ void
 mac_destroy_vnode(struct vnode *vp)
 {
 
-	mac_destroy_vnode_label(&vp->v_label);
+	mac_vnode_label_free(vp->v_label);
+	vp->v_label = NULL;
 }
 
 void
@@ -205,8 +261,8 @@ mac_update_devfsdirent(struct mount *mp, struct devfs_dirent *de,
     struct vnode *vp)
 {
 
-	MAC_PERFORM(update_devfsdirent, mp, de, &de->de_label, vp,
-	    &vp->v_label);
+	MAC_PERFORM(update_devfsdirent, mp, de, de->de_label, vp,
+	    vp->v_label);
 }
 
 void
@@ -214,8 +270,8 @@ mac_associate_vnode_devfs(struct mount *mp, struct devfs_dirent *de,
     struct vnode *vp)
 {
 
-	MAC_PERFORM(associate_vnode_devfs, mp, &mp->mnt_fslabel, de,
-	    &de->de_label, vp, &vp->v_label);
+	MAC_PERFORM(associate_vnode_devfs, mp, mp->mnt_fslabel, de,
+	    de->de_label, vp, vp->v_label);
 }
 
 int
@@ -225,8 +281,8 @@ mac_associate_vnode_extattr(struct mount *mp, struct vnode *vp)
 
 	ASSERT_VOP_LOCKED(vp, "mac_associate_vnode_extattr");
 
-	MAC_CHECK(associate_vnode_extattr, mp, &mp->mnt_fslabel, vp,
-	    &vp->v_label);
+	MAC_CHECK(associate_vnode_extattr, mp, mp->mnt_fslabel, vp,
+	    vp->v_label);
 
 	return (error);
 }
@@ -235,8 +291,8 @@ void
 mac_associate_vnode_singlelabel(struct mount *mp, struct vnode *vp)
 {
 
-	MAC_PERFORM(associate_vnode_singlelabel, mp, &mp->mnt_fslabel, vp,
-	    &vp->v_label);
+	MAC_PERFORM(associate_vnode_singlelabel, mp, mp->mnt_fslabel, vp,
+	    vp->v_label);
 }
 
 int
@@ -259,8 +315,8 @@ mac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 	} else if (error)
 		return (error);
 
-	MAC_CHECK(create_vnode_extattr, cred, mp, &mp->mnt_fslabel,
-	    dvp, &dvp->v_label, vp, &vp->v_label, cnp);
+	MAC_CHECK(create_vnode_extattr, cred, mp, mp->mnt_fslabel,
+	    dvp, dvp->v_label, vp, vp->v_label, cnp);
 
 	if (error) {
 		VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
@@ -294,7 +350,7 @@ mac_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
 	} else if (error)
 		return (error);
 
-	MAC_CHECK(setlabel_vnode_extattr, cred, vp, &vp->v_label, intlabel);
+	MAC_CHECK(setlabel_vnode_extattr, cred, vp, vp->v_label, intlabel);
 
 	if (error) {
 		VOP_CLOSEEXTATTR(vp, 0, NOCRED, curthread);
@@ -319,7 +375,7 @@ mac_execve_transition(struct ucred *old, struct ucred *new, struct vnode *vp,
 	if (!mac_enforce_process && !mac_enforce_fs)
 		return;
 
-	MAC_PERFORM(execve_transition, old, new, vp, &vp->v_label,
+	MAC_PERFORM(execve_transition, old, new, vp, vp->v_label,
 	    interpvnodelabel, imgp, imgp->execlabel);
 }
 
@@ -335,7 +391,7 @@ mac_execve_will_transition(struct ucred *old, struct vnode *vp,
 		return (0);
 
 	result = 0;
-	MAC_BOOLEAN(execve_will_transition, ||, old, vp, &vp->v_label,
+	MAC_BOOLEAN(execve_will_transition, ||, old, vp, vp->v_label,
 	    interpvnodelabel, imgp, imgp->execlabel);
 
 	return (result);
@@ -351,7 +407,7 @@ mac_check_vnode_access(struct ucred *cred, struct vnode *vp, int acc_mode)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_access, cred, vp, &vp->v_label, acc_mode);
+	MAC_CHECK(check_vnode_access, cred, vp, vp->v_label, acc_mode);
 	return (error);
 }
 
@@ -365,7 +421,7 @@ mac_check_vnode_chdir(struct ucred *cred, struct vnode *dvp)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_chdir, cred, dvp, &dvp->v_label);
+	MAC_CHECK(check_vnode_chdir, cred, dvp, dvp->v_label);
 	return (error);
 }
 
@@ -379,7 +435,7 @@ mac_check_vnode_chroot(struct ucred *cred, struct vnode *dvp)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_chroot, cred, dvp, &dvp->v_label);
+	MAC_CHECK(check_vnode_chroot, cred, dvp, dvp->v_label);
 	return (error);
 }
 
@@ -394,7 +450,7 @@ mac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_create, cred, dvp, &dvp->v_label, cnp, vap);
+	MAC_CHECK(check_vnode_create, cred, dvp, dvp->v_label, cnp, vap);
 	return (error);
 }
 
@@ -410,8 +466,8 @@ mac_check_vnode_delete(struct ucred *cred, struct vnode *dvp, struct vnode *vp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_delete, cred, dvp, &dvp->v_label, vp,
-	    &vp->v_label, cnp);
+	MAC_CHECK(check_vnode_delete, cred, dvp, dvp->v_label, vp,
+	    vp->v_label, cnp);
 	return (error);
 }
 
@@ -426,7 +482,7 @@ mac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_deleteacl, cred, vp, &vp->v_label, type);
+	MAC_CHECK(check_vnode_deleteacl, cred, vp, vp->v_label, type);
 	return (error);
 }
 
@@ -441,7 +497,7 @@ mac_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_deleteextattr, cred, vp, &vp->v_label,
+	MAC_CHECK(check_vnode_deleteextattr, cred, vp, vp->v_label,
 	    attrnamespace, name);
 	return (error);
 }
@@ -457,7 +513,7 @@ mac_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 	if (!mac_enforce_process && !mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_exec, cred, vp, &vp->v_label, imgp,
+	MAC_CHECK(check_vnode_exec, cred, vp, vp->v_label, imgp,
 	    imgp->execlabel);
 
 	return (error);
@@ -473,7 +529,7 @@ mac_check_vnode_getacl(struct ucred *cred, struct vnode *vp, acl_type_t type)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_getacl, cred, vp, &vp->v_label, type);
+	MAC_CHECK(check_vnode_getacl, cred, vp, vp->v_label, type);
 	return (error);
 }
 
@@ -488,7 +544,7 @@ mac_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_getextattr, cred, vp, &vp->v_label,
+	MAC_CHECK(check_vnode_getextattr, cred, vp, vp->v_label,
 	    attrnamespace, name, uio);
 	return (error);
 }
@@ -505,8 +561,8 @@ mac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_link, cred, dvp, &dvp->v_label, vp,
-	    &vp->v_label, cnp);
+	MAC_CHECK(check_vnode_link, cred, dvp, dvp->v_label, vp,
+	    vp->v_label, cnp);
 	return (error);
 }
 
@@ -521,7 +577,7 @@ mac_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_listextattr, cred, vp, &vp->v_label,
+	MAC_CHECK(check_vnode_listextattr, cred, vp, vp->v_label,
 	    attrnamespace);
 	return (error);
 }
@@ -537,7 +593,7 @@ mac_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_lookup, cred, dvp, &dvp->v_label, cnp);
+	MAC_CHECK(check_vnode_lookup, cred, dvp, dvp->v_label, cnp);
 	return (error);
 }
 
@@ -551,7 +607,7 @@ mac_check_vnode_mmap(struct ucred *cred, struct vnode *vp, int prot)
 	if (!mac_enforce_fs || !mac_enforce_vm)
 		return (0);
 
-	MAC_CHECK(check_vnode_mmap, cred, vp, &vp->v_label, prot);
+	MAC_CHECK(check_vnode_mmap, cred, vp, vp->v_label, prot);
 	return (error);
 }
 
@@ -565,7 +621,7 @@ mac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp, int *prot)
 	if (!mac_enforce_fs || !mac_enforce_vm)
 		return;
 
-	MAC_PERFORM(check_vnode_mmap_downgrade, cred, vp, &vp->v_label,
+	MAC_PERFORM(check_vnode_mmap_downgrade, cred, vp, vp->v_label,
 	    &result);
 
 	*prot = result;
@@ -581,7 +637,7 @@ mac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp, int prot)
 	if (!mac_enforce_fs || !mac_enforce_vm)
 		return (0);
 
-	MAC_CHECK(check_vnode_mprotect, cred, vp, &vp->v_label, prot);
+	MAC_CHECK(check_vnode_mprotect, cred, vp, vp->v_label, prot);
 	return (error);
 }
 
@@ -595,7 +651,7 @@ mac_check_vnode_open(struct ucred *cred, struct vnode *vp, int acc_mode)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_open, cred, vp, &vp->v_label, acc_mode);
+	MAC_CHECK(check_vnode_open, cred, vp, vp->v_label, acc_mode);
 	return (error);
 }
 
@@ -611,7 +667,7 @@ mac_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
 		return (0);
 
 	MAC_CHECK(check_vnode_poll, active_cred, file_cred, vp,
-	    &vp->v_label);
+	    vp->v_label);
 
 	return (error);
 }
@@ -628,7 +684,7 @@ mac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
 		return (0);
 
 	MAC_CHECK(check_vnode_read, active_cred, file_cred, vp,
-	    &vp->v_label);
+	    vp->v_label);
 
 	return (error);
 }
@@ -643,7 +699,7 @@ mac_check_vnode_readdir(struct ucred *cred, struct vnode *dvp)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_readdir, cred, dvp, &dvp->v_label);
+	MAC_CHECK(check_vnode_readdir, cred, dvp, dvp->v_label);
 	return (error);
 }
 
@@ -657,7 +713,7 @@ mac_check_vnode_readlink(struct ucred *cred, struct vnode *vp)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_readlink, cred, vp, &vp->v_label);
+	MAC_CHECK(check_vnode_readlink, cred, vp, vp->v_label);
 	return (error);
 }
 
@@ -669,7 +725,7 @@ mac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 
 	ASSERT_VOP_LOCKED(vp, "mac_check_vnode_relabel");
 
-	MAC_CHECK(check_vnode_relabel, cred, vp, &vp->v_label, newlabel);
+	MAC_CHECK(check_vnode_relabel, cred, vp, vp->v_label, newlabel);
 
 	return (error);
 }
@@ -686,8 +742,8 @@ mac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_rename_from, cred, dvp, &dvp->v_label, vp,
-	    &vp->v_label, cnp);
+	MAC_CHECK(check_vnode_rename_from, cred, dvp, dvp->v_label, vp,
+	    vp->v_label, cnp);
 	return (error);
 }
 
@@ -703,8 +759,8 @@ mac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_rename_to, cred, dvp, &dvp->v_label, vp,
-	    vp != NULL ? &vp->v_label : NULL, samedir, cnp);
+	MAC_CHECK(check_vnode_rename_to, cred, dvp, dvp->v_label, vp,
+	    vp != NULL ? vp->v_label : NULL, samedir, cnp);
 	return (error);
 }
 
@@ -718,7 +774,7 @@ mac_check_vnode_revoke(struct ucred *cred, struct vnode *vp)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_revoke, cred, vp, &vp->v_label);
+	MAC_CHECK(check_vnode_revoke, cred, vp, vp->v_label);
 	return (error);
 }
 
@@ -733,7 +789,7 @@ mac_check_vnode_setacl(struct ucred *cred, struct vnode *vp, acl_type_t type,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_setacl, cred, vp, &vp->v_label, type, acl);
+	MAC_CHECK(check_vnode_setacl, cred, vp, vp->v_label, type, acl);
 	return (error);
 }
 
@@ -748,7 +804,7 @@ mac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_setextattr, cred, vp, &vp->v_label,
+	MAC_CHECK(check_vnode_setextattr, cred, vp, vp->v_label,
 	    attrnamespace, name, uio);
 	return (error);
 }
@@ -763,7 +819,7 @@ mac_check_vnode_setflags(struct ucred *cred, struct vnode *vp, u_long flags)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_setflags, cred, vp, &vp->v_label, flags);
+	MAC_CHECK(check_vnode_setflags, cred, vp, vp->v_label, flags);
 	return (error);
 }
 
@@ -777,7 +833,7 @@ mac_check_vnode_setmode(struct ucred *cred, struct vnode *vp, mode_t mode)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_setmode, cred, vp, &vp->v_label, mode);
+	MAC_CHECK(check_vnode_setmode, cred, vp, vp->v_label, mode);
 	return (error);
 }
 
@@ -792,7 +848,7 @@ mac_check_vnode_setowner(struct ucred *cred, struct vnode *vp, uid_t uid,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_setowner, cred, vp, &vp->v_label, uid, gid);
+	MAC_CHECK(check_vnode_setowner, cred, vp, vp->v_label, uid, gid);
 	return (error);
 }
 
@@ -807,7 +863,7 @@ mac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_vnode_setutimes, cred, vp, &vp->v_label, atime,
+	MAC_CHECK(check_vnode_setutimes, cred, vp, vp->v_label, atime,
 	    mtime);
 	return (error);
 }
@@ -824,7 +880,7 @@ mac_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
 		return (0);
 
 	MAC_CHECK(check_vnode_stat, active_cred, file_cred, vp,
-	    &vp->v_label);
+	    vp->v_label);
 	return (error);
 }
 
@@ -840,7 +896,7 @@ mac_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
 		return (0);
 
 	MAC_CHECK(check_vnode_write, active_cred, file_cred, vp,
-	    &vp->v_label);
+	    vp->v_label);
 
 	return (error);
 }
@@ -849,23 +905,23 @@ void
 mac_relabel_vnode(struct ucred *cred, struct vnode *vp, struct label *newlabel)
 {
 
-	MAC_PERFORM(relabel_vnode, cred, vp, &vp->v_label, newlabel);
+	MAC_PERFORM(relabel_vnode, cred, vp, vp->v_label, newlabel);
 }
 
 void
 mac_create_mount(struct ucred *cred, struct mount *mp)
 {
 
-	MAC_PERFORM(create_mount, cred, mp, &mp->mnt_mntlabel,
-	    &mp->mnt_fslabel);
+	MAC_PERFORM(create_mount, cred, mp, mp->mnt_mntlabel,
+	    mp->mnt_fslabel);
 }
 
 void
 mac_create_root_mount(struct ucred *cred, struct mount *mp)
 {
 
-	MAC_PERFORM(create_root_mount, cred, mp, &mp->mnt_mntlabel,
-	    &mp->mnt_fslabel);
+	MAC_PERFORM(create_root_mount, cred, mp, mp->mnt_mntlabel,
+	    mp->mnt_fslabel);
 }
 
 int
@@ -876,7 +932,7 @@ mac_check_mount_stat(struct ucred *cred, struct mount *mount)
 	if (!mac_enforce_fs)
 		return (0);
 
-	MAC_CHECK(check_mount_stat, cred, mount, &mount->mnt_mntlabel);
+	MAC_CHECK(check_mount_stat, cred, mount, mount->mnt_mntlabel);
 
 	return (error);
 }
@@ -885,7 +941,7 @@ void
 mac_create_devfs_device(struct mount *mp, dev_t dev, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_device, mp, dev, de, &de->de_label);
+	MAC_PERFORM(create_devfs_device, mp, dev, de, de->de_label);
 }
 
 void
@@ -893,8 +949,8 @@ mac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct devfs_dirent *dd, struct devfs_dirent *de)
 {
 
-	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, &dd->de_label, de,
-	    &de->de_label);
+	MAC_PERFORM(create_devfs_symlink, cred, mp, dd, dd->de_label, de,
+	    de->de_label);
 }
 
 void
@@ -903,7 +959,7 @@ mac_create_devfs_directory(struct mount *mp, char *dirname, int dirnamelen,
 {
 
 	MAC_PERFORM(create_devfs_directory, mp, dirname, dirnamelen, de,
-	    &de->de_label);
+	    de->de_label);
 }
 
 /*
diff --git a/sys/security/mac_biba/mac_biba.c b/sys/security/mac_biba/mac_biba.c
index d82584246d1d..768958384010 100644
--- a/sys/security/mac_biba/mac_biba.c
+++ b/sys/security/mac_biba/mac_biba.c
@@ -811,11 +811,11 @@ mac_biba_create_devfs_directory(struct mount *mp, char *dirname,
 static void
 mac_biba_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
-    struct label *delabel)
+    struct label *delabel, const char *fullpath)
 {
 	struct mac_biba *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(delabel);
 
 	mac_biba_copy_single(source, dest);
@@ -827,7 +827,7 @@ mac_biba_create_mount(struct ucred *cred, struct mount *mp,
 {
 	struct mac_biba *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(mntlabel);
 	mac_biba_copy_single(source, dest);
 	dest = SLOT(fslabel);
@@ -949,7 +949,7 @@ mac_biba_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 	buflen = sizeof(temp);
 	bzero(&temp, buflen);
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(vlabel);
 	mac_biba_copy_single(source, &temp);
 
@@ -1003,7 +1003,7 @@ mac_biba_create_socket(struct ucred *cred, struct socket *socket,
 {
 	struct mac_biba *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(socketlabel);
 
 	mac_biba_copy_single(source, dest);
@@ -1015,7 +1015,7 @@ mac_biba_create_pipe(struct ucred *cred, struct pipe *pipe,
 {
 	struct mac_biba *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(pipelabel);
 
 	mac_biba_copy_single(source, dest);
@@ -1092,7 +1092,7 @@ mac_biba_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
 {
 	struct mac_biba *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(bpflabel);
 
 	mac_biba_copy_single(source, dest);
@@ -1313,8 +1313,8 @@ mac_biba_create_cred(struct ucred *cred_parent, struct ucred *cred_child)
 {
 	struct mac_biba *source, *dest;
 
-	source = SLOT(&cred_parent->cr_label);
-	dest = SLOT(&cred_child->cr_label);
+	source = SLOT(cred_parent->cr_label);
+	dest = SLOT(cred_child->cr_label);
 
 	mac_biba_copy_single(source, dest);
 	mac_biba_copy_range(source, dest);
@@ -1325,7 +1325,7 @@ mac_biba_create_proc0(struct ucred *cred)
 {
 	struct mac_biba *dest;
 
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_biba_set_single(dest, MAC_BIBA_TYPE_EQUAL, 0, NULL);
 	mac_biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL,
@@ -1337,7 +1337,7 @@ mac_biba_create_proc1(struct ucred *cred)
 {
 	struct mac_biba *dest;
 
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_biba_set_single(dest, MAC_BIBA_TYPE_HIGH, 0, NULL);
 	mac_biba_set_range(dest, MAC_BIBA_TYPE_LOW, 0, NULL,
@@ -1350,7 +1350,7 @@ mac_biba_relabel_cred(struct ucred *cred, struct label *newlabel)
 	struct mac_biba *source, *dest;
 
 	source = SLOT(newlabel);
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_biba_copy(source, dest);
 }
@@ -1381,7 +1381,7 @@ mac_biba_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 	struct mac_biba *subj, *new;
 	int error;
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	new = SLOT(newlabel);
 
 	/*
@@ -1445,8 +1445,8 @@ mac_biba_check_cred_visible(struct ucred *u1, struct ucred *u2)
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&u1->cr_label);
-	obj = SLOT(&u2->cr_label);
+	subj = SLOT(u1->cr_label);
+	obj = SLOT(u2->cr_label);
 
 	/* XXX: range */
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1462,7 +1462,7 @@ mac_biba_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
 	struct mac_biba *subj, *new;
 	int error;
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	new = SLOT(newlabel);
 
 	/*
@@ -1508,7 +1508,7 @@ mac_biba_check_kld_load(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	error = mac_biba_subject_privileged(subj);
 	if (error)
@@ -1530,7 +1530,7 @@ mac_biba_check_kld_unload(struct ucred *cred)
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	return (mac_biba_subject_privileged(subj));
 }
@@ -1544,7 +1544,7 @@ mac_biba_check_mount_stat(struct ucred *cred, struct mount *mp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(mntlabel);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1575,7 +1575,7 @@ mac_biba_check_pipe_poll(struct ucred *cred, struct pipe *pipe,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1593,7 +1593,7 @@ mac_biba_check_pipe_read(struct ucred *cred, struct pipe *pipe,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1610,7 +1610,7 @@ mac_biba_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
 	int error;
 
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(pipelabel);
 
 	/*
@@ -1662,7 +1662,7 @@ mac_biba_check_pipe_stat(struct ucred *cred, struct pipe *pipe,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1680,7 +1680,7 @@ mac_biba_check_pipe_write(struct ucred *cred, struct pipe *pipe,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -1697,8 +1697,8 @@ mac_biba_check_proc_debug(struct ucred *cred, struct proc *proc)
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1717,8 +1717,8 @@ mac_biba_check_proc_sched(struct ucred *cred, struct proc *proc)
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1737,8 +1737,8 @@ mac_biba_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1772,7 +1772,7 @@ mac_biba_check_socket_relabel(struct ucred *cred, struct socket *so,
 	int error;
 
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(socketlabel);
 
 	/*
@@ -1824,7 +1824,7 @@ mac_biba_check_socket_visible(struct ucred *cred, struct socket *socket,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(socketlabel);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1842,7 +1842,7 @@ mac_biba_check_sysarch_ioperm(struct ucred *cred)
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	error = mac_biba_subject_privileged(subj);
 	if (error)
@@ -1861,7 +1861,7 @@ mac_biba_check_system_acct(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	error = mac_biba_subject_privileged(subj);
 	if (error)
@@ -1886,7 +1886,7 @@ mac_biba_check_system_settime(struct ucred *cred)
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	error = mac_biba_subject_privileged(subj);
 	if (error)
@@ -1905,7 +1905,7 @@ mac_biba_check_system_swapon(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	error = mac_biba_subject_privileged(subj);
@@ -1928,7 +1928,7 @@ mac_biba_check_system_swapoff(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	error = mac_biba_subject_privileged(subj);
@@ -1948,7 +1948,7 @@ mac_biba_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	/*
 	 * In general, treat sysctl variables as biba/high, but also
@@ -1981,7 +1981,7 @@ mac_biba_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -1999,7 +1999,7 @@ mac_biba_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2017,7 +2017,7 @@ mac_biba_check_vnode_create(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2036,7 +2036,7 @@ mac_biba_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2059,7 +2059,7 @@ mac_biba_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2077,7 +2077,7 @@ mac_biba_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2109,7 +2109,7 @@ mac_biba_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2127,7 +2127,7 @@ mac_biba_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2145,7 +2145,7 @@ mac_biba_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2164,7 +2164,7 @@ mac_biba_check_vnode_link(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2187,7 +2187,7 @@ mac_biba_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2205,7 +2205,7 @@ mac_biba_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2227,7 +2227,7 @@ mac_biba_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
@@ -2251,7 +2251,7 @@ mac_biba_check_vnode_open(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	/* XXX privilege override for admin? */
@@ -2276,7 +2276,7 @@ mac_biba_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_biba_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2294,7 +2294,7 @@ mac_biba_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_biba_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2312,7 +2312,7 @@ mac_biba_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2330,7 +2330,7 @@ mac_biba_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2348,7 +2348,7 @@ mac_biba_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 
 	old = SLOT(vnodelabel);
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	/*
 	 * If there is a Biba label update for the vnode, it must be a
@@ -2400,7 +2400,7 @@ mac_biba_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2424,7 +2424,7 @@ mac_biba_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2449,7 +2449,7 @@ mac_biba_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2467,7 +2467,7 @@ mac_biba_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2486,7 +2486,7 @@ mac_biba_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2506,7 +2506,7 @@ mac_biba_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2524,7 +2524,7 @@ mac_biba_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2542,7 +2542,7 @@ mac_biba_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2560,7 +2560,7 @@ mac_biba_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_biba_dominate_single(subj, obj))
@@ -2578,7 +2578,7 @@ mac_biba_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_biba_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_biba_dominate_single(obj, subj))
@@ -2596,7 +2596,7 @@ mac_biba_check_vnode_write(struct ucred *active_cred,
 	if (!mac_biba_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_biba_dominate_single(subj, obj))
diff --git a/sys/security/mac_lomac/mac_lomac.c b/sys/security/mac_lomac/mac_lomac.c
index c6261bfd98e1..be13a479f8ec 100644
--- a/sys/security/mac_lomac/mac_lomac.c
+++ b/sys/security/mac_lomac/mac_lomac.c
@@ -499,7 +499,7 @@ maybe_demote(struct mac_lomac *subjlabel, struct mac_lomac *objlabel,
 	struct proc *p;
 	pid_t pgid;
 
-	subj = PSLOT(&curthread->td_proc->p_label);
+	subj = PSLOT(curthread->td_proc->p_label);
 
 	p = curthread->td_proc;
 	mtx_lock(&subj->mtx);
@@ -941,7 +941,7 @@ mac_lomac_create_devfs_symlink(struct ucred *cred, struct mount *mp,
 {
 	struct mac_lomac *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(delabel);
 
 	mac_lomac_copy_single(source, dest);
@@ -953,7 +953,7 @@ mac_lomac_create_mount(struct ucred *cred, struct mount *mp,
 {
 	struct mac_lomac *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(mntlabel);
 	mac_lomac_copy_single(source, dest);
 	dest = SLOT(fslabel);
@@ -1082,7 +1082,7 @@ mac_lomac_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 	buflen = sizeof(temp);
 	bzero(&temp, buflen);
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(vlabel);
 	dir = SLOT(dlabel);
 	if (dir->ml_flags & MAC_LOMAC_FLAG_AUX) {
@@ -1142,7 +1142,7 @@ mac_lomac_create_socket(struct ucred *cred, struct socket *socket,
 {
 	struct mac_lomac *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(socketlabel);
 
 	mac_lomac_copy_single(source, dest);
@@ -1154,7 +1154,7 @@ mac_lomac_create_pipe(struct ucred *cred, struct pipe *pipe,
 {
 	struct mac_lomac *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(pipelabel);
 
 	mac_lomac_copy_single(source, dest);
@@ -1231,7 +1231,7 @@ mac_lomac_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
 {
 	struct mac_lomac *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(bpflabel);
 
 	mac_lomac_copy_single(source, dest);
@@ -1453,8 +1453,8 @@ mac_lomac_create_cred(struct ucred *cred_parent, struct ucred *cred_child)
 {
 	struct mac_lomac *source, *dest;
 
-	source = SLOT(&cred_parent->cr_label);
-	dest = SLOT(&cred_child->cr_label);
+	source = SLOT(cred_parent->cr_label);
+	dest = SLOT(cred_child->cr_label);
 
 	mac_lomac_copy_single(source, dest);
 	mac_lomac_copy_range(source, dest);
@@ -1468,8 +1468,8 @@ mac_lomac_execve_transition(struct ucred *old, struct ucred *new,
 {
 	struct mac_lomac *source, *dest, *obj, *robj;
 
-	source = SLOT(&old->cr_label);
-	dest = SLOT(&new->cr_label);
+	source = SLOT(old->cr_label);
+	dest = SLOT(new->cr_label);
 	obj = SLOT(vnodelabel);
 	robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
 
@@ -1507,7 +1507,7 @@ mac_lomac_execve_will_transition(struct ucred *old, struct vnode *vp,
 	if (!mac_lomac_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&old->cr_label);
+	subj = SLOT(old->cr_label);
 	obj = SLOT(vnodelabel);
 	robj = interpvnodelabel != NULL ? SLOT(interpvnodelabel) : obj;
 
@@ -1522,7 +1522,7 @@ mac_lomac_create_proc0(struct ucred *cred)
 {
 	struct mac_lomac *dest;
 
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_lomac_set_single(dest, MAC_LOMAC_TYPE_EQUAL, 0);
 	mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
@@ -1534,7 +1534,7 @@ mac_lomac_create_proc1(struct ucred *cred)
 {
 	struct mac_lomac *dest;
 
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_lomac_set_single(dest, MAC_LOMAC_TYPE_HIGH, 0);
 	mac_lomac_set_range(dest, MAC_LOMAC_TYPE_LOW, 0, MAC_LOMAC_TYPE_HIGH,
@@ -1547,7 +1547,7 @@ mac_lomac_relabel_cred(struct ucred *cred, struct label *newlabel)
 	struct mac_lomac *source, *dest;
 
 	source = SLOT(newlabel);
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	try_relabel(source, dest);
 }
@@ -1578,7 +1578,7 @@ mac_lomac_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 	struct mac_lomac *subj, *new;
 	int error;
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	new = SLOT(newlabel);
 
 	/*
@@ -1646,8 +1646,8 @@ mac_lomac_check_cred_visible(struct ucred *u1, struct ucred *u2)
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&u1->cr_label);
-	obj = SLOT(&u2->cr_label);
+	subj = SLOT(u1->cr_label);
+	obj = SLOT(u2->cr_label);
 
 	/* XXX: range */
 	if (!mac_lomac_dominate_single(obj, subj))
@@ -1663,7 +1663,7 @@ mac_lomac_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
 	struct mac_lomac *subj, *new;
 	int error;
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	new = SLOT(newlabel);
 
 	/*
@@ -1735,7 +1735,7 @@ mac_lomac_check_kld_load(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (mac_lomac_subject_privileged(subj))
@@ -1755,7 +1755,7 @@ mac_lomac_check_kld_unload(struct ucred *cred)
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	if (mac_lomac_subject_privileged(subj))
 		return (EPERM);
@@ -1785,7 +1785,7 @@ mac_lomac_check_pipe_read(struct ucred *cred, struct pipe *pipe,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_lomac_dominate_single(obj, subj))
@@ -1802,7 +1802,7 @@ mac_lomac_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
 	int error;
 
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(pipelabel);
 
 	/*
@@ -1854,7 +1854,7 @@ mac_lomac_check_pipe_write(struct ucred *cred, struct pipe *pipe,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -1871,8 +1871,8 @@ mac_lomac_check_proc_debug(struct ucred *cred, struct proc *proc)
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_lomac_dominate_single(obj, subj))
@@ -1891,8 +1891,8 @@ mac_lomac_check_proc_sched(struct ucred *cred, struct proc *proc)
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_lomac_dominate_single(obj, subj))
@@ -1911,8 +1911,8 @@ mac_lomac_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_lomac_dominate_single(obj, subj))
@@ -1946,7 +1946,7 @@ mac_lomac_check_socket_relabel(struct ucred *cred, struct socket *socket,
 	int error;
 
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(socketlabel);
 
 	/*
@@ -1998,7 +1998,7 @@ mac_lomac_check_socket_visible(struct ucred *cred, struct socket *socket,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(socketlabel);
 
 	if (!mac_lomac_dominate_single(obj, subj))
@@ -2016,7 +2016,7 @@ mac_lomac_check_system_swapon(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (mac_lomac_subject_privileged(subj))
@@ -2037,7 +2037,7 @@ mac_lomac_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	/*
 	 * In general, treat sysctl variables as lomac/high, but also
@@ -2071,7 +2071,7 @@ mac_lomac_check_vnode_create(struct ucred *cred, struct vnode *dvp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2093,7 +2093,7 @@ mac_lomac_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2116,7 +2116,7 @@ mac_lomac_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2135,7 +2135,7 @@ mac_lomac_check_vnode_link(struct ucred *cred, struct vnode *dvp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2162,7 +2162,7 @@ mac_lomac_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (prot & VM_PROT_WRITE) {
@@ -2190,7 +2190,7 @@ mac_lomac_check_vnode_mprotect(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (prot & VM_PROT_WRITE) {
@@ -2218,7 +2218,7 @@ mac_lomac_check_vnode_mmap_downgrade(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled || !revocation_enabled)
 		return;
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2234,7 +2234,7 @@ mac_lomac_check_vnode_open(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	/* XXX privilege override for admin? */
@@ -2255,7 +2255,7 @@ mac_lomac_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_lomac_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_lomac_dominate_single(obj, subj))
@@ -2273,7 +2273,7 @@ mac_lomac_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 
 	old = SLOT(vnodelabel);
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	/*
 	 * If there is a LOMAC label update for the vnode, it must be a
@@ -2350,7 +2350,7 @@ mac_lomac_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2374,7 +2374,7 @@ mac_lomac_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2399,7 +2399,7 @@ mac_lomac_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2417,7 +2417,7 @@ mac_lomac_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2436,7 +2436,7 @@ mac_lomac_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2456,7 +2456,7 @@ mac_lomac_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2474,7 +2474,7 @@ mac_lomac_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2492,7 +2492,7 @@ mac_lomac_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2510,7 +2510,7 @@ mac_lomac_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
 	if (!mac_lomac_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2528,7 +2528,7 @@ mac_lomac_check_vnode_write(struct ucred *active_cred,
 	if (!mac_lomac_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_lomac_subject_dominate(subj, obj))
@@ -2541,7 +2541,7 @@ static void
 mac_lomac_thread_userret(struct thread *td)
 {
 	struct proc *p = td->td_proc;
-	struct mac_lomac_proc *subj = PSLOT(&p->p_label);
+	struct mac_lomac_proc *subj = PSLOT(p->p_label);
 	struct ucred *newcred, *oldcred;
 	int dodrop;
 
@@ -2568,7 +2568,7 @@ mac_lomac_thread_userret(struct thread *td)
 		oldcred = p->p_ucred;
 		crcopy(newcred, oldcred);
 		crhold(newcred);
-		mac_lomac_copy(&subj->mac_lomac, SLOT(&newcred->cr_label));
+		mac_lomac_copy(&subj->mac_lomac, SLOT(newcred->cr_label));
 		p->p_ucred = newcred;
 		crfree(oldcred);
 		dodrop = 1;
diff --git a/sys/security/mac_mls/mac_mls.c b/sys/security/mac_mls/mac_mls.c
index eb3c320d274a..69bd3748a737 100644
--- a/sys/security/mac_mls/mac_mls.c
+++ b/sys/security/mac_mls/mac_mls.c
@@ -781,11 +781,11 @@ mac_mls_create_devfs_directory(struct mount *mp, char *dirname,
 static void
 mac_mls_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct devfs_dirent *dd, struct label *ddlabel, struct devfs_dirent *de,
-    struct label *delabel)
+    struct label *delabel, const char *fullpath)
 {
 	struct mac_mls *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(delabel);
 
 	mac_mls_copy_single(source, dest);
@@ -797,7 +797,7 @@ mac_mls_create_mount(struct ucred *cred, struct mount *mp,
 {
 	struct mac_mls *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(mntlabel);
 	mac_mls_copy_single(source, dest);
 	dest = SLOT(fslabel);
@@ -919,7 +919,7 @@ mac_mls_create_vnode_extattr(struct ucred *cred, struct mount *mp,
 	buflen = sizeof(temp);
 	bzero(&temp, buflen);
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(vlabel);
 	mac_mls_copy_single(source, &temp);
 
@@ -973,7 +973,7 @@ mac_mls_create_socket(struct ucred *cred, struct socket *socket,
 {
 	struct mac_mls *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(socketlabel);
 
 	mac_mls_copy_single(source, dest);
@@ -985,7 +985,7 @@ mac_mls_create_pipe(struct ucred *cred, struct pipe *pipe,
 {
 	struct mac_mls *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(pipelabel);
 
 	mac_mls_copy_single(source, dest);
@@ -1062,7 +1062,7 @@ mac_mls_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
 {
 	struct mac_mls *source, *dest;
 
-	source = SLOT(&cred->cr_label);
+	source = SLOT(cred->cr_label);
 	dest = SLOT(bpflabel);
 
 	mac_mls_copy_single(source, dest);
@@ -1243,8 +1243,8 @@ mac_mls_create_cred(struct ucred *cred_parent, struct ucred *cred_child)
 {
 	struct mac_mls *source, *dest;
 
-	source = SLOT(&cred_parent->cr_label);
-	dest = SLOT(&cred_child->cr_label);
+	source = SLOT(cred_parent->cr_label);
+	dest = SLOT(cred_child->cr_label);
 
 	mac_mls_copy_single(source, dest);
 	mac_mls_copy_range(source, dest);
@@ -1255,7 +1255,7 @@ mac_mls_create_proc0(struct ucred *cred)
 {
 	struct mac_mls *dest;
 
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_mls_set_single(dest, MAC_MLS_TYPE_EQUAL, 0, NULL);
 	mac_mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH,
@@ -1267,7 +1267,7 @@ mac_mls_create_proc1(struct ucred *cred)
 {
 	struct mac_mls *dest;
 
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_mls_set_single(dest, MAC_MLS_TYPE_LOW, 0, NULL);
 	mac_mls_set_range(dest, MAC_MLS_TYPE_LOW, 0, NULL, MAC_MLS_TYPE_HIGH,
@@ -1280,7 +1280,7 @@ mac_mls_relabel_cred(struct ucred *cred, struct label *newlabel)
 	struct mac_mls *source, *dest;
 
 	source = SLOT(newlabel);
-	dest = SLOT(&cred->cr_label);
+	dest = SLOT(cred->cr_label);
 
 	mac_mls_copy(source, dest);
 }
@@ -1311,7 +1311,7 @@ mac_mls_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 	struct mac_mls *subj, *new;
 	int error;
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	new = SLOT(newlabel);
 
 	/*
@@ -1375,8 +1375,8 @@ mac_mls_check_cred_visible(struct ucred *u1, struct ucred *u2)
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&u1->cr_label);
-	obj = SLOT(&u2->cr_label);
+	subj = SLOT(u1->cr_label);
+	obj = SLOT(u2->cr_label);
 
 	/* XXX: range */
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1392,7 +1392,7 @@ mac_mls_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
 	struct mac_mls *subj, *new;
 	int error;
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	new = SLOT(newlabel);
 
 	/*
@@ -1435,7 +1435,7 @@ mac_mls_check_mount_stat(struct ucred *cred, struct mount *mp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(mntlabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1466,7 +1466,7 @@ mac_mls_check_pipe_poll(struct ucred *cred, struct pipe *pipe,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1484,7 +1484,7 @@ mac_mls_check_pipe_read(struct ucred *cred, struct pipe *pipe,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1501,7 +1501,7 @@ mac_mls_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
 	int error;
 
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(pipelabel);
 
 	/*
@@ -1553,7 +1553,7 @@ mac_mls_check_pipe_stat(struct ucred *cred, struct pipe *pipe,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1571,7 +1571,7 @@ mac_mls_check_pipe_write(struct ucred *cred, struct pipe *pipe,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT((pipelabel));
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -1588,8 +1588,8 @@ mac_mls_check_proc_debug(struct ucred *cred, struct proc *proc)
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1608,8 +1608,8 @@ mac_mls_check_proc_sched(struct ucred *cred, struct proc *proc)
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1628,8 +1628,8 @@ mac_mls_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
-	obj = SLOT(&proc->p_ucred->cr_label);
+	subj = SLOT(cred->cr_label);
+	obj = SLOT(proc->p_ucred->cr_label);
 
 	/* XXX: range checks */
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1663,7 +1663,7 @@ mac_mls_check_socket_relabel(struct ucred *cred, struct socket *socket,
 	int error;
 
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(socketlabel);
 
 	/*
@@ -1715,7 +1715,7 @@ mac_mls_check_socket_visible(struct ucred *cred, struct socket *socket,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(socketlabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1733,7 +1733,7 @@ mac_mls_check_system_swapon(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(obj, subj) ||
@@ -1752,7 +1752,7 @@ mac_mls_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1770,7 +1770,7 @@ mac_mls_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1788,7 +1788,7 @@ mac_mls_check_vnode_create(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -1807,7 +1807,7 @@ mac_mls_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -1830,7 +1830,7 @@ mac_mls_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -1848,7 +1848,7 @@ mac_mls_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -1880,7 +1880,7 @@ mac_mls_check_vnode_exec(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1898,7 +1898,7 @@ mac_mls_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1916,7 +1916,7 @@ mac_mls_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1935,7 +1935,7 @@ mac_mls_check_vnode_link(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -1958,7 +1958,7 @@ mac_mls_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1976,7 +1976,7 @@ mac_mls_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -1998,7 +1998,7 @@ mac_mls_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (prot & (VM_PROT_READ | VM_PROT_EXECUTE)) {
@@ -2022,7 +2022,7 @@ mac_mls_check_vnode_open(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	/* XXX privilege override for admin? */
@@ -2047,7 +2047,7 @@ mac_mls_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_mls_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -2065,7 +2065,7 @@ mac_mls_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_mls_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -2083,7 +2083,7 @@ mac_mls_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -2101,7 +2101,7 @@ mac_mls_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -2119,7 +2119,7 @@ mac_mls_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
 
 	old = SLOT(vnodelabel);
 	new = SLOT(newlabel);
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 
 	/*
 	 * If there is an MLS label update for the vnode, it must be a
@@ -2172,7 +2172,7 @@ mac_mls_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2196,7 +2196,7 @@ mac_mls_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(dlabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2221,7 +2221,7 @@ mac_mls_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2239,7 +2239,7 @@ mac_mls_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2258,7 +2258,7 @@ mac_mls_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2278,7 +2278,7 @@ mac_mls_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2296,7 +2296,7 @@ mac_mls_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2314,7 +2314,7 @@ mac_mls_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2332,7 +2332,7 @@ mac_mls_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&cred->cr_label);
+	subj = SLOT(cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_mls_dominate_single(obj, subj))
@@ -2350,7 +2350,7 @@ mac_mls_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_mls_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(vnodelabel);
 
 	if (!mac_mls_dominate_single(subj, obj))
@@ -2368,7 +2368,7 @@ mac_mls_check_vnode_write(struct ucred *active_cred, struct ucred *file_cred,
 	if (!mac_mls_enabled || !revocation_enabled)
 		return (0);
 
-	subj = SLOT(&active_cred->cr_label);
+	subj = SLOT(active_cred->cr_label);
 	obj = SLOT(label);
 
 	if (!mac_mls_dominate_single(obj, subj))
diff --git a/sys/security/mac_partition/mac_partition.c b/sys/security/mac_partition/mac_partition.c
index ed5bc2eca710..74df98c7c943 100644
--- a/sys/security/mac_partition/mac_partition.c
+++ b/sys/security/mac_partition/mac_partition.c
@@ -134,21 +134,21 @@ static void
 mac_partition_create_cred(struct ucred *cred_parent, struct ucred *cred_child)
 {
 
-	SLOT(&cred_child->cr_label) = SLOT(&cred_parent->cr_label);
+	SLOT(cred_child->cr_label) = SLOT(cred_parent->cr_label);
 }
 
 static void
 mac_partition_create_proc0(struct ucred *cred)
 {
 
-	SLOT(&cred->cr_label) = 0;
+	SLOT(cred->cr_label) = 0;
 }
 
 static void
 mac_partition_create_proc1(struct ucred *cred)
 {
 
-	SLOT(&cred->cr_label) = 0;
+	SLOT(cred->cr_label) = 0;
 }
 
 static void
@@ -156,7 +156,7 @@ mac_partition_relabel_cred(struct ucred *cred, struct label *newlabel)
 {
 
 	if (SLOT(newlabel) != 0)
-		SLOT(&cred->cr_label) = SLOT(newlabel);
+		SLOT(cred->cr_label) = SLOT(newlabel);
 }
 
 static int
@@ -201,7 +201,7 @@ mac_partition_check_cred_visible(struct ucred *u1, struct ucred *u2)
 {
 	int error;
 
-	error = label_on_label(&u1->cr_label, &u2->cr_label);
+	error = label_on_label(u1->cr_label, u2->cr_label);
 
 	return (error == 0 ? 0 : ESRCH);
 }
@@ -211,7 +211,7 @@ mac_partition_check_proc_debug(struct ucred *cred, struct proc *proc)
 {
 	int error;
 
-	error = label_on_label(&cred->cr_label, &proc->p_ucred->cr_label);
+	error = label_on_label(cred->cr_label, proc->p_ucred->cr_label);
 
 	return (error ? ESRCH : 0);
 }
@@ -221,7 +221,7 @@ mac_partition_check_proc_sched(struct ucred *cred, struct proc *proc)
 {
 	int error;
 
-	error = label_on_label(&cred->cr_label, &proc->p_ucred->cr_label);
+	error = label_on_label(cred->cr_label, proc->p_ucred->cr_label);
 
 	return (error ? ESRCH : 0);
 }
@@ -232,7 +232,7 @@ mac_partition_check_proc_signal(struct ucred *cred, struct proc *proc,
 {
 	int error;
 
-	error = label_on_label(&cred->cr_label, &proc->p_ucred->cr_label);
+	error = label_on_label(cred->cr_label, proc->p_ucred->cr_label);
 
 	return (error ? ESRCH : 0);
 }
@@ -243,7 +243,7 @@ mac_partition_check_socket_visible(struct ucred *cred, struct socket *socket,
 {
 	int error;
 
-	error = label_on_label(&cred->cr_label, socketlabel);
+	error = label_on_label(cred->cr_label, socketlabel);
 
 	return (error ? ENOENT : 0);
 }
diff --git a/sys/security/mac_test/mac_test.c b/sys/security/mac_test/mac_test.c
index 1aafa92d5123..322667944b44 100644
--- a/sys/security/mac_test/mac_test.c
+++ b/sys/security/mac_test/mac_test.c
@@ -635,7 +635,7 @@ mac_test_create_devfs_symlink(struct ucred *cred, struct mount *mp,
     struct label *delabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_DEVFS_LABEL(ddlabel);
 	ASSERT_DEVFS_LABEL(delabel);
 }
@@ -646,7 +646,7 @@ mac_test_create_vnode_extattr(struct ucred *cred, struct mount *mp,
     struct vnode *vp, struct label *vlabel, struct componentname *cnp)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_MOUNT_LABEL(fslabel);
 	ASSERT_VNODE_LABEL(dlabel);
 
@@ -658,7 +658,7 @@ mac_test_create_mount(struct ucred *cred, struct mount *mp,
     struct label *mntlabel, struct label *fslabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_MOUNT_LABEL(mntlabel);
 	ASSERT_MOUNT_LABEL(fslabel);
 }
@@ -668,7 +668,7 @@ mac_test_create_root_mount(struct ucred *cred, struct mount *mp,
     struct label *mntlabel, struct label *fslabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_MOUNT_LABEL(mntlabel);
 	ASSERT_MOUNT_LABEL(fslabel);
 }
@@ -678,7 +678,7 @@ mac_test_relabel_vnode(struct ucred *cred, struct vnode *vp,
     struct label *vnodelabel, struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(vnodelabel);
 	ASSERT_VNODE_LABEL(label);
 }
@@ -688,7 +688,7 @@ mac_test_setlabel_vnode_extattr(struct ucred *cred, struct vnode *vp,
     struct label *vlabel, struct label *intlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(vlabel);
 	ASSERT_VNODE_LABEL(intlabel);
 	return (0);
@@ -721,7 +721,7 @@ mac_test_create_socket(struct ucred *cred, struct socket *socket,
    struct label *socketlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_SOCKET_LABEL(socketlabel);
 }
 
@@ -730,7 +730,7 @@ mac_test_create_pipe(struct ucred *cred, struct pipe *pipe,
    struct label *pipelabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 }
 
@@ -749,7 +749,7 @@ mac_test_relabel_socket(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_SOCKET_LABEL(newlabel);
 }
 
@@ -758,7 +758,7 @@ mac_test_relabel_pipe(struct ucred *cred, struct pipe *pipe,
     struct label *pipelabel, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 	ASSERT_PIPE_LABEL(newlabel);
 }
@@ -790,7 +790,7 @@ mac_test_create_bpfdesc(struct ucred *cred, struct bpf_d *bpf_d,
     struct label *bpflabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_BPF_LABEL(bpflabel);
 }
 
@@ -916,7 +916,7 @@ mac_test_relabel_ifnet(struct ucred *cred, struct ifnet *ifnet,
     struct label *ifnetlabel, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_IFNET_LABEL(ifnetlabel);
 	ASSERT_IFNET_LABEL(newlabel);
 }
@@ -937,8 +937,8 @@ static void
 mac_test_create_cred(struct ucred *cred_parent, struct ucred *cred_child)
 {
 
-	ASSERT_CRED_LABEL(&cred_parent->cr_label);
-	ASSERT_CRED_LABEL(&cred_child->cr_label);
+	ASSERT_CRED_LABEL(cred_parent->cr_label);
+	ASSERT_CRED_LABEL(cred_child->cr_label);
 }
 
 static void
@@ -948,8 +948,8 @@ mac_test_execve_transition(struct ucred *old, struct ucred *new,
     struct label *execlabel)
 {
 
-	ASSERT_CRED_LABEL(&old->cr_label);
-	ASSERT_CRED_LABEL(&new->cr_label);
+	ASSERT_CRED_LABEL(old->cr_label);
+	ASSERT_CRED_LABEL(new->cr_label);
 	ASSERT_VNODE_LABEL(filelabel);
 	ASSERT_VNODE_LABEL(interpvnodelabel);
 	if (execlabel != NULL) {
@@ -963,7 +963,7 @@ mac_test_execve_will_transition(struct ucred *old, struct vnode *vp,
     struct image_params *imgp, struct label *execlabel)
 {
 
-	ASSERT_CRED_LABEL(&old->cr_label);
+	ASSERT_CRED_LABEL(old->cr_label);
 	ASSERT_VNODE_LABEL(filelabel);
 	if (interpvnodelabel != NULL) {
 		ASSERT_VNODE_LABEL(interpvnodelabel);
@@ -979,21 +979,21 @@ static void
 mac_test_create_proc0(struct ucred *cred)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 }
 
 static void
 mac_test_create_proc1(struct ucred *cred)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 }
 
 static void
 mac_test_relabel_cred(struct ucred *cred, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(newlabel);
 }
 
@@ -1023,7 +1023,7 @@ static int
 mac_test_check_cred_relabel(struct ucred *cred, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_CRED_LABEL(newlabel);
 
 	return (0);
@@ -1033,8 +1033,8 @@ static int
 mac_test_check_cred_visible(struct ucred *u1, struct ucred *u2)
 {
 
-	ASSERT_CRED_LABEL(&u1->cr_label);
-	ASSERT_CRED_LABEL(&u2->cr_label);
+	ASSERT_CRED_LABEL(u1->cr_label);
+	ASSERT_CRED_LABEL(u2->cr_label);
 
 	return (0);
 }
@@ -1044,7 +1044,7 @@ mac_test_check_ifnet_relabel(struct ucred *cred, struct ifnet *ifnet,
     struct label *ifnetlabel, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_IFNET_LABEL(ifnetlabel);
 	ASSERT_IFNET_LABEL(newlabel);
 	return (0);
@@ -1074,7 +1074,7 @@ static int
 mac_test_check_kenv_get(struct ucred *cred, char *name)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1083,7 +1083,7 @@ static int
 mac_test_check_kenv_set(struct ucred *cred, char *name, char *value)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1092,7 +1092,7 @@ static int
 mac_test_check_kenv_unset(struct ucred *cred, char *name)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1102,7 +1102,7 @@ mac_test_check_kld_load(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1112,7 +1112,7 @@ static int
 mac_test_check_kld_stat(struct ucred *cred)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1121,7 +1121,7 @@ static int
 mac_test_check_kld_unload(struct ucred *cred)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1131,7 +1131,7 @@ mac_test_check_mount_stat(struct ucred *cred, struct mount *mp,
     struct label *mntlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_MOUNT_LABEL(mntlabel);
 
 	return (0);
@@ -1142,7 +1142,7 @@ mac_test_check_pipe_ioctl(struct ucred *cred, struct pipe *pipe,
     struct label *pipelabel, unsigned long cmd, void /* caddr_t */ *data)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 
 	return (0);
@@ -1153,7 +1153,7 @@ mac_test_check_pipe_poll(struct ucred *cred, struct pipe *pipe,
     struct label *pipelabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 
 	return (0);
@@ -1164,7 +1164,7 @@ mac_test_check_pipe_read(struct ucred *cred, struct pipe *pipe,
     struct label *pipelabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 
 	return (0);
@@ -1175,7 +1175,7 @@ mac_test_check_pipe_relabel(struct ucred *cred, struct pipe *pipe,
     struct label *pipelabel, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 	ASSERT_PIPE_LABEL(newlabel);
 
@@ -1187,7 +1187,7 @@ mac_test_check_pipe_stat(struct ucred *cred, struct pipe *pipe,
     struct label *pipelabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 
 	return (0);
@@ -1198,7 +1198,7 @@ mac_test_check_pipe_write(struct ucred *cred, struct pipe *pipe,
     struct label *pipelabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_PIPE_LABEL(pipelabel);
 
 	return (0);
@@ -1208,8 +1208,8 @@ static int
 mac_test_check_proc_debug(struct ucred *cred, struct proc *proc)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
-	ASSERT_CRED_LABEL(&proc->p_ucred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
+	ASSERT_CRED_LABEL(proc->p_ucred->cr_label);
 
 	return (0);
 }
@@ -1218,8 +1218,8 @@ static int
 mac_test_check_proc_sched(struct ucred *cred, struct proc *proc)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
-	ASSERT_CRED_LABEL(&proc->p_ucred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
+	ASSERT_CRED_LABEL(proc->p_ucred->cr_label);
 
 	return (0);
 }
@@ -1228,8 +1228,8 @@ static int
 mac_test_check_proc_signal(struct ucred *cred, struct proc *proc, int signum)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
-	ASSERT_CRED_LABEL(&proc->p_ucred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
+	ASSERT_CRED_LABEL(proc->p_ucred->cr_label);
 
 	return (0);
 }
@@ -1239,7 +1239,7 @@ mac_test_check_socket_bind(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct sockaddr *sockaddr)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_SOCKET_LABEL(socketlabel);
 
 	return (0);
@@ -1250,7 +1250,7 @@ mac_test_check_socket_connect(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct sockaddr *sockaddr)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_SOCKET_LABEL(socketlabel);
 
 	return (0);
@@ -1272,7 +1272,7 @@ mac_test_check_socket_listen(struct ucred *cred, struct socket *socket,
     struct label *socketlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_SOCKET_LABEL(socketlabel);
 
 	return (0);
@@ -1283,7 +1283,7 @@ mac_test_check_socket_visible(struct ucred *cred, struct socket *socket,
     struct label *socketlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_SOCKET_LABEL(socketlabel);
 
 	return (0);
@@ -1294,7 +1294,7 @@ mac_test_check_socket_relabel(struct ucred *cred, struct socket *socket,
     struct label *socketlabel, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_SOCKET_LABEL(socketlabel);
 	ASSERT_SOCKET_LABEL(newlabel);
 
@@ -1305,7 +1305,7 @@ static int
 mac_test_check_sysarch_ioperm(struct ucred *cred)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1315,7 +1315,7 @@ mac_test_check_system_acct(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1324,7 +1324,7 @@ static int
 mac_test_check_system_reboot(struct ucred *cred, int how)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1333,7 +1333,7 @@ static int
 mac_test_check_system_settime(struct ucred *cred)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1343,7 +1343,7 @@ mac_test_check_system_swapon(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1354,7 +1354,7 @@ mac_test_check_system_swapoff(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1365,7 +1365,7 @@ mac_test_check_system_sysctl(struct ucred *cred, int *name, u_int namelen,
     void *old, size_t *oldlenp, int inkernel, void *new, size_t newlen)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 
 	return (0);
 }
@@ -1375,7 +1375,7 @@ mac_test_check_vnode_access(struct ucred *cred, struct vnode *vp,
     struct label *label, int acc_mode)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1386,7 +1386,7 @@ mac_test_check_vnode_chdir(struct ucred *cred, struct vnode *dvp,
     struct label *dlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 
 	return (0);
@@ -1397,7 +1397,7 @@ mac_test_check_vnode_chroot(struct ucred *cred, struct vnode *dvp,
     struct label *dlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 
 	return (0);
@@ -1408,7 +1408,7 @@ mac_test_check_vnode_create(struct ucred *cred, struct vnode *dvp,
     struct label *dlabel, struct componentname *cnp, struct vattr *vap)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 
 	return (0);
@@ -1420,7 +1420,7 @@ mac_test_check_vnode_delete(struct ucred *cred, struct vnode *dvp,
     struct componentname *cnp)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 	ASSERT_VNODE_LABEL(label);
 
@@ -1432,7 +1432,7 @@ mac_test_check_vnode_deleteacl(struct ucred *cred, struct vnode *vp,
     struct label *label, acl_type_t type)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1443,7 +1443,7 @@ mac_test_check_vnode_deleteextattr(struct ucred *cred, struct vnode *vp,
     struct label *label, int attrnamespace, const char *name)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1455,7 +1455,7 @@ mac_test_check_vnode_exec(struct ucred *cred, struct vnode *vp,
     struct label *execlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 	if (execlabel != NULL) {
 		ASSERT_CRED_LABEL(execlabel);
@@ -1469,7 +1469,7 @@ mac_test_check_vnode_getacl(struct ucred *cred, struct vnode *vp,
     struct label *label, acl_type_t type)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1480,7 +1480,7 @@ mac_test_check_vnode_getextattr(struct ucred *cred, struct vnode *vp,
     struct label *label, int attrnamespace, const char *name, struct uio *uio)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1492,7 +1492,7 @@ mac_test_check_vnode_link(struct ucred *cred, struct vnode *dvp,
     struct componentname *cnp)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 	ASSERT_VNODE_LABEL(label);
 
@@ -1504,7 +1504,7 @@ mac_test_check_vnode_listextattr(struct ucred *cred, struct vnode *vp,
     struct label *label, int attrnamespace)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1515,7 +1515,7 @@ mac_test_check_vnode_lookup(struct ucred *cred, struct vnode *dvp,
     struct label *dlabel, struct componentname *cnp)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 
 	return (0);
@@ -1526,7 +1526,7 @@ mac_test_check_vnode_mmap(struct ucred *cred, struct vnode *vp,
     struct label *label, int prot)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1537,7 +1537,7 @@ mac_test_check_vnode_mprotect(struct ucred *cred, struct vnode *vp,
     struct label *label, int prot)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1548,7 +1548,7 @@ mac_test_check_vnode_open(struct ucred *cred, struct vnode *vp,
     struct label *filelabel, int acc_mode)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(filelabel);
 
 	return (0);
@@ -1559,8 +1559,8 @@ mac_test_check_vnode_poll(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&active_cred->cr_label);
-	ASSERT_CRED_LABEL(&file_cred->cr_label);
+	ASSERT_CRED_LABEL(active_cred->cr_label);
+	ASSERT_CRED_LABEL(file_cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1571,9 +1571,9 @@ mac_test_check_vnode_read(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&active_cred->cr_label);
+	ASSERT_CRED_LABEL(active_cred->cr_label);
 	if (file_cred != NULL) {
-		ASSERT_CRED_LABEL(&file_cred->cr_label);
+		ASSERT_CRED_LABEL(file_cred->cr_label);
 	}
 	ASSERT_VNODE_LABEL(label);
 
@@ -1585,7 +1585,7 @@ mac_test_check_vnode_readdir(struct ucred *cred, struct vnode *dvp,
     struct label *dlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 
 	return (0);
@@ -1596,7 +1596,7 @@ mac_test_check_vnode_readlink(struct ucred *cred, struct vnode *vp,
     struct label *vnodelabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(vnodelabel);
 
 	return (0);
@@ -1607,7 +1607,7 @@ mac_test_check_vnode_relabel(struct ucred *cred, struct vnode *vp,
     struct label *vnodelabel, struct label *newlabel)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(vnodelabel);
 	ASSERT_VNODE_LABEL(newlabel);
 
@@ -1620,7 +1620,7 @@ mac_test_check_vnode_rename_from(struct ucred *cred, struct vnode *dvp,
     struct componentname *cnp)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 	ASSERT_VNODE_LABEL(label);
 
@@ -1633,7 +1633,7 @@ mac_test_check_vnode_rename_to(struct ucred *cred, struct vnode *dvp,
     struct componentname *cnp)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(dlabel);
 
 	if (vp != NULL) {
@@ -1648,7 +1648,7 @@ mac_test_check_vnode_revoke(struct ucred *cred, struct vnode *vp,
     struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1659,7 +1659,7 @@ mac_test_check_vnode_setacl(struct ucred *cred, struct vnode *vp,
     struct label *label, acl_type_t type, struct acl *acl)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1670,7 +1670,7 @@ mac_test_check_vnode_setextattr(struct ucred *cred, struct vnode *vp,
     struct label *label, int attrnamespace, const char *name, struct uio *uio)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1681,7 +1681,7 @@ mac_test_check_vnode_setflags(struct ucred *cred, struct vnode *vp,
     struct label *label, u_long flags)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1692,7 +1692,7 @@ mac_test_check_vnode_setmode(struct ucred *cred, struct vnode *vp,
     struct label *label, mode_t mode)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1703,7 +1703,7 @@ mac_test_check_vnode_setowner(struct ucred *cred, struct vnode *vp,
     struct label *label, uid_t uid, gid_t gid)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1714,7 +1714,7 @@ mac_test_check_vnode_setutimes(struct ucred *cred, struct vnode *vp,
     struct label *label, struct timespec atime, struct timespec mtime)
 {
 
-	ASSERT_CRED_LABEL(&cred->cr_label);
+	ASSERT_CRED_LABEL(cred->cr_label);
 	ASSERT_VNODE_LABEL(label);
 
 	return (0);
@@ -1725,9 +1725,9 @@ mac_test_check_vnode_stat(struct ucred *active_cred, struct ucred *file_cred,
     struct vnode *vp, struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&active_cred->cr_label);
+	ASSERT_CRED_LABEL(active_cred->cr_label);
 	if (file_cred != NULL) {
-		ASSERT_CRED_LABEL(&file_cred->cr_label);
+		ASSERT_CRED_LABEL(file_cred->cr_label);
 	}
 	ASSERT_VNODE_LABEL(label);
 
@@ -1739,9 +1739,9 @@ mac_test_check_vnode_write(struct ucred *active_cred,
     struct ucred *file_cred, struct vnode *vp, struct label *label)
 {
 
-	ASSERT_CRED_LABEL(&active_cred->cr_label);
+	ASSERT_CRED_LABEL(active_cred->cr_label);
 	if (file_cred != NULL) {
-		ASSERT_CRED_LABEL(&file_cred->cr_label);
+		ASSERT_CRED_LABEL(file_cred->cr_label);
 	}
 	ASSERT_VNODE_LABEL(label);
 
diff --git a/sys/sys/mac.h b/sys/sys/mac.h
index 7955c25aa611..1dc6bf111fae 100644
--- a/sys/sys/mac.h
+++ b/sys/sys/mac.h
@@ -144,7 +144,6 @@ int	mac_init_mbuf_tag(struct m_tag *, int flag);
 void	mac_init_mount(struct mount *);
 void	mac_init_proc(struct proc *);
 void	mac_init_vnode(struct vnode *);
-void	mac_init_vnode_label(struct label *);
 void	mac_copy_mbuf_tag(struct m_tag *, struct m_tag *);
 void	mac_copy_vnode_label(struct label *, struct label *label);
 void	mac_destroy_bpfdesc(struct bpf_d *);
@@ -158,7 +157,12 @@ void	mac_destroy_proc(struct proc *);
 void	mac_destroy_mbuf_tag(struct m_tag *);
 void	mac_destroy_mount(struct mount *);
 void	mac_destroy_vnode(struct vnode *);
-void	mac_destroy_vnode_label(struct label *);
+
+struct label	*mac_cred_label_alloc(void);
+void		 mac_cred_label_free(struct label *label);
+struct label	*mac_vnode_label_alloc(void);
+void		 mac_vnode_label_free(struct label *label);
+void		 mac_destroy_vnode_label(struct label *);
 
 /*
  * Labeling event operations: file system objects, and things that
@@ -220,8 +224,7 @@ void	mac_update_ipq(struct mbuf *fragment, struct ipq *ipq);
  * Labeling event operations: processes.
  */
 void	mac_create_cred(struct ucred *cred_parent, struct ucred *cred_child);
-int	mac_execve_enter(struct image_params *imgp, struct mac *mac_p,
-	    struct label *execlabel);
+int	mac_execve_enter(struct image_params *imgp, struct mac *mac_p);
 void	mac_execve_exit(struct image_params *imgp);
 void	mac_execve_transition(struct ucred *old, struct ucred *new,
 	    struct vnode *vp, struct label *interpvnodelabel,
diff --git a/sys/sys/mount.h b/sys/sys/mount.h
index 49d27991b65b..61aeb8452829 100644
--- a/sys/sys/mount.h
+++ b/sys/sys/mount.h
@@ -41,7 +41,6 @@
 #include <sys/queue.h>
 #ifdef _KERNEL
 #include <sys/lockmgr.h>
-#include <sys/_label.h>
 #include <sys/_lock.h>
 #include <sys/_mutex.h>
 #endif
@@ -145,8 +144,8 @@ struct mount {
 	time_t		mnt_time;		/* last time written*/
 	int		mnt_iosize_max;		/* max size for clusters, etc */
 	struct netexport *mnt_export;		/* export list */
-	struct label	mnt_mntlabel;		/* MAC label for the mount */
-	struct label	mnt_fslabel;		/* MAC label for the fs */
+	struct label	*mnt_mntlabel;		/* MAC label for the mount */
+	struct label	*mnt_fslabel;		/* MAC label for the fs */
 	int		mnt_nvnodelistsize;	/* # of vnodes on this mount */
 };
 
diff --git a/sys/sys/pipe.h b/sys/sys/pipe.h
index 93103f6905e4..bdb9104d1454 100644
--- a/sys/sys/pipe.h
+++ b/sys/sys/pipe.h
@@ -28,7 +28,6 @@
 #include <sys/time.h>			/* for struct timespec */
 #include <sys/selinfo.h>		/* for struct selinfo */
 #include <vm/vm.h>			/* for vm_page_t */
-#include <sys/_label.h>			/* for struct label */
 #include <machine/param.h>		/* for PAGE_SIZE */
 #endif
 
diff --git a/sys/sys/proc.h b/sys/sys/proc.h
index 70632f8906ee..792abba82fed 100644
--- a/sys/sys/proc.h
+++ b/sys/sys/proc.h
@@ -55,7 +55,6 @@
 #include <sys/runq.h>
 #include <sys/sigio.h>
 #include <sys/signal.h>
-#include <sys/_label.h>
 #ifndef _KERNEL
 #include <sys/time.h>			/* For structs itimerval, timeval. */
 #else
@@ -616,7 +615,7 @@ struct proc {
 	struct proc	*p_peers;	/* (r) */
 	struct proc	*p_leader;	/* (b) */
 	void		*p_emuldata;	/* (c) Emulator state data. */
-	struct label	p_label;	/* (*) Process (not subject) MAC label */
+	struct label	*p_label;	/* (*) Proc (not subject) MAC label. */
 	struct p_sched	*p_sched;	/* (*) Scheduler-specific data. */
 };
 
diff --git a/sys/sys/socketvar.h b/sys/sys/socketvar.h
index 2b0a0cb1511b..1277c2b1a773 100644
--- a/sys/sys/socketvar.h
+++ b/sys/sys/socketvar.h
@@ -37,7 +37,6 @@
 #ifndef _SYS_SOCKETVAR_H_
 #define _SYS_SOCKETVAR_H_
 
-#include <sys/_label.h>			/* for struct label */
 #include <sys/queue.h>			/* for TAILQ macros */
 #include <sys/selinfo.h>		/* for struct selinfo */
 
@@ -128,8 +127,8 @@ struct socket {
 	void	(*so_upcall)(struct socket *, void *, int);
 	void	*so_upcallarg;
 	struct	ucred *so_cred;		/* user credentials */
-	struct	label so_label;		/* MAC label for socket */
-	struct	label so_peerlabel;	/* cached MAC label for socket peer */
+	struct	label *so_label;	/* MAC label for socket */
+	struct	label *so_peerlabel;	/* cached MAC label for socket peer */
 	/* NB: generation count must not be first; easiest to make it last. */
 	so_gen_t so_gencnt;		/* generation count */
 	void	*so_emuldata;		/* private data for emulators */
diff --git a/sys/sys/ucred.h b/sys/sys/ucred.h
index 448d5c3ad9a4..e8f38bf705ee 100644
--- a/sys/sys/ucred.h
+++ b/sys/sys/ucred.h
@@ -44,7 +44,6 @@
  * Only the suser() or suser_cred() function should be used for this.
  */
 #if defined(_KERNEL) || defined(_WANT_UCRED)
-#include <sys/_label.h>
 
 struct ucred {
 	u_int	cr_ref;			/* reference count */
@@ -60,7 +59,7 @@ struct ucred {
 	struct uidinfo	*cr_ruidinfo;	/* per ruid resource consumption */
 	struct prison	*cr_prison;	/* jail(2) */
 #define	cr_endcopy	cr_label
-	struct label	cr_label;	/* MAC label */
+	struct label	*cr_label;	/* MAC label */
 	struct mtx	*cr_mtxp;      	/* protect refcount */
 };
 #define	NOCRED	((struct ucred *)0)	/* no credential available */
diff --git a/sys/sys/vnode.h b/sys/sys/vnode.h
index 1c91c9442a51..1d85ba5d45b7 100644
--- a/sys/sys/vnode.h
+++ b/sys/sys/vnode.h
@@ -44,7 +44,6 @@
 #include <sys/lockmgr.h>
 
 #include <sys/queue.h>
-#include <sys/_label.h>
 #include <sys/_lock.h>
 #include <sys/lock.h>
 #include <sys/_mutex.h>
@@ -153,7 +152,7 @@ struct vnode {
 	struct	vnode *v_dd;			/* c .. vnode */
 	u_long	v_ddid;				/* c .. capability identifier */
 	struct vpollinfo *v_pollinfo;		/* p Poll events */
-	struct label v_label;			/* MAC label for vnode */
+	struct label *v_label;			/* MAC label for vnode */
 #ifdef	DEBUG_LOCKS
 	const char *filename;			/* Source file doing locking */
 	int line;				/* Line number doing locking */