9 files changed, 4 insertions, 4819 deletions

diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index cb7222c029a3..bf58634527e7 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -327,7 +327,8 @@ struct mac_policy_ops {
 		    struct componentname *cnp, struct vattr *vap);
 	int	(*mpo_check_vnode_delete)(struct ucred *cred,
 		    struct vnode *dvp, struct label *dlabel,
-		    struct vnode *vp, void *label, struct componentname *cnp);
+		    struct vnode *vp, struct label *label,
+		    struct componentname *cnp);
 	int	(*mpo_check_vnode_deleteacl)(struct ucred *cred,
 		    struct vnode *vp, struct label *label, acl_type_t type);
 	int	(*mpo_check_vnode_exec)(struct ucred *cred, struct vnode *vp,
@@ -397,161 +398,10 @@ struct mac_policy_ops {
 		    struct label *label);
 };
 
-typedef const void *macop_t;
-
-enum mac_op_constant {
-	MAC_OP_LAST,
-	MAC_DESTROY,
-	MAC_INIT,
-	MAC_SYSCALL,
-	MAC_INIT_BPFDESC_LABEL,
-	MAC_INIT_CRED_LABEL,
-	MAC_INIT_DEVFSDIRENT_LABEL,
-	MAC_INIT_IFNET_LABEL,
-	MAC_INIT_IPQ_LABEL,
-	MAC_INIT_MBUF_LABEL,
-	MAC_INIT_MOUNT_LABEL,
-	MAC_INIT_MOUNT_FS_LABEL,
-	MAC_INIT_PIPE_LABEL,
-	MAC_INIT_SOCKET_LABEL,
-	MAC_INIT_SOCKET_PEER_LABEL,
-	MAC_INIT_VNODE_LABEL,
-	MAC_DESTROY_BPFDESC_LABEL,
-	MAC_DESTROY_CRED_LABEL,
-	MAC_DESTROY_DEVFSDIRENT_LABEL,
-	MAC_DESTROY_IFNET_LABEL,
-	MAC_DESTROY_IPQ_LABEL,
-	MAC_DESTROY_MBUF_LABEL,
-	MAC_DESTROY_MOUNT_LABEL,
-	MAC_DESTROY_MOUNT_FS_LABEL,
-	MAC_DESTROY_PIPE_LABEL,
-	MAC_DESTROY_SOCKET_LABEL,
-	MAC_DESTROY_SOCKET_PEER_LABEL,
-	MAC_DESTROY_VNODE_LABEL,
-	MAC_COPY_PIPE_LABEL,
-	MAC_COPY_VNODE_LABEL,
-	MAC_EXTERNALIZE_CRED_LABEL,
-	MAC_EXTERNALIZE_IFNET_LABEL,
-	MAC_EXTERNALIZE_PIPE_LABEL,
-	MAC_EXTERNALIZE_SOCKET_LABEL,
-	MAC_EXTERNALIZE_SOCKET_PEER_LABEL,
-	MAC_EXTERNALIZE_VNODE_LABEL,
-	MAC_INTERNALIZE_CRED_LABEL,
-	MAC_INTERNALIZE_IFNET_LABEL,
-	MAC_INTERNALIZE_PIPE_LABEL,
-	MAC_INTERNALIZE_SOCKET_LABEL,
-	MAC_INTERNALIZE_VNODE_LABEL,
-	MAC_CREATE_DEVFS_DEVICE,
-	MAC_CREATE_DEVFS_DIRECTORY,
-	MAC_CREATE_DEVFS_SYMLINK,
-	MAC_CREATE_DEVFS_VNODE,
-	MAC_CREATE_MOUNT,
-	MAC_CREATE_ROOT_MOUNT,
-	MAC_RELABEL_VNODE,
-	MAC_UPDATE_DEVFSDIRENT,
-	MAC_ASSOCIATE_VNODE_DEVFS,
-	MAC_ASSOCIATE_VNODE_EXTATTR,
-	MAC_ASSOCIATE_VNODE_SINGLELABEL,
-	MAC_CREATE_VNODE_EXTATTR,
-	MAC_SETLABEL_VNODE_EXTATTR,
-	MAC_CREATE_MBUF_FROM_SOCKET,
-	MAC_CREATE_PIPE,
-	MAC_CREATE_SOCKET,
-	MAC_CREATE_SOCKET_FROM_SOCKET,
-	MAC_RELABEL_PIPE,
-	MAC_RELABEL_SOCKET,
-	MAC_SET_SOCKET_PEER_FROM_MBUF,
-	MAC_SET_SOCKET_PEER_FROM_SOCKET,
-	MAC_CREATE_BPFDESC,
-	MAC_CREATE_DATAGRAM_FROM_IPQ,
-	MAC_CREATE_IFNET,
-	MAC_CREATE_IPQ,
-	MAC_CREATE_FRAGMENT,
-	MAC_CREATE_MBUF_FROM_MBUF,
-	MAC_CREATE_MBUF_LINKLAYER,
-	MAC_CREATE_MBUF_FROM_BPFDESC,
-	MAC_CREATE_MBUF_FROM_IFNET,
-	MAC_CREATE_MBUF_MULTICAST_ENCAP,
-	MAC_CREATE_MBUF_NETLAYER,
-	MAC_FRAGMENT_MATCH,
-	MAC_RELABEL_IFNET,
-	MAC_UPDATE_IPQ,
-	MAC_CREATE_CRED,
-	MAC_EXECVE_TRANSITION,
-	MAC_EXECVE_WILL_TRANSITION,
-	MAC_CREATE_PROC0,
-	MAC_CREATE_PROC1,
-	MAC_RELABEL_CRED,
-	MAC_THREAD_USERRET,
-	MAC_CHECK_BPFDESC_RECEIVE,
-	MAC_CHECK_CRED_RELABEL,
-	MAC_CHECK_CRED_VISIBLE,
-	MAC_CHECK_IFNET_RELABEL,
-	MAC_CHECK_IFNET_TRANSMIT,
-	MAC_CHECK_MOUNT_STAT,
-	MAC_CHECK_PIPE_IOCTL,
-	MAC_CHECK_PIPE_POLL,
-	MAC_CHECK_PIPE_READ,
-	MAC_CHECK_PIPE_RELABEL,
-	MAC_CHECK_PIPE_STAT,
-	MAC_CHECK_PIPE_WRITE,
-	MAC_CHECK_PROC_DEBUG,
-	MAC_CHECK_PROC_SCHED,
-	MAC_CHECK_PROC_SIGNAL,
-	MAC_CHECK_SOCKET_BIND,
-	MAC_CHECK_SOCKET_CONNECT,
-	MAC_CHECK_SOCKET_DELIVER,
-	MAC_CHECK_SOCKET_LISTEN,
-	MAC_CHECK_SOCKET_RECEIVE,
-	MAC_CHECK_SOCKET_RELABEL,
-	MAC_CHECK_SOCKET_SEND,
-	MAC_CHECK_SOCKET_VISIBLE,
-	MAC_CHECK_SYSTEM_REBOOT,
-	MAC_CHECK_SYSTEM_SWAPON,
-	MAC_CHECK_SYSTEM_SYSCTL,
-	MAC_CHECK_VNODE_ACCESS,
-	MAC_CHECK_VNODE_CHDIR,
-	MAC_CHECK_VNODE_CHROOT,
-	MAC_CHECK_VNODE_CREATE,
-	MAC_CHECK_VNODE_DELETE,
-	MAC_CHECK_VNODE_DELETEACL,
-	MAC_CHECK_VNODE_EXEC,
-	MAC_CHECK_VNODE_GETACL,
-	MAC_CHECK_VNODE_GETEXTATTR,
-	MAC_CHECK_VNODE_LINK,
-	MAC_CHECK_VNODE_LOOKUP,
-	MAC_CHECK_VNODE_MMAP,
-	MAC_CHECK_VNODE_MMAP_DOWNGRADE,
-	MAC_CHECK_VNODE_MPROTECT,
-	MAC_CHECK_VNODE_OPEN,
-	MAC_CHECK_VNODE_POLL,
-	MAC_CHECK_VNODE_READ,
-	MAC_CHECK_VNODE_READDIR,
-	MAC_CHECK_VNODE_READLINK,
-	MAC_CHECK_VNODE_RELABEL,
-	MAC_CHECK_VNODE_RENAME_FROM,
-	MAC_CHECK_VNODE_RENAME_TO,
-	MAC_CHECK_VNODE_REVOKE,
-	MAC_CHECK_VNODE_SETACL,
-	MAC_CHECK_VNODE_SETEXTATTR,
-	MAC_CHECK_VNODE_SETFLAGS,
-	MAC_CHECK_VNODE_SETMODE,
-	MAC_CHECK_VNODE_SETOWNER,
-	MAC_CHECK_VNODE_SETUTIMES,
-	MAC_CHECK_VNODE_STAT,
-	MAC_CHECK_VNODE_WRITE,
-};
-
-struct mac_policy_op_entry {
-	enum mac_op_constant mpe_constant;	/* what this hook implements */
-	macop_t mpe_function;			/* hook's implementation */
-};
-
 struct mac_policy_conf {
 	char				*mpc_name;	/* policy name */
 	char				*mpc_fullname;	/* policy full name */
 	struct mac_policy_ops		*mpc_ops;	/* policy operations */
-	struct mac_policy_op_entry	*mpc_entries;	/* ops to fill in */
 	int				 mpc_loadtime_flags;	/* flags */
 	int				*mpc_field_off; /* security field */
 	int				 mpc_runtime_flags; /* flags */
@@ -565,12 +415,11 @@ struct mac_policy_conf {
 /* Flags for the mpc_runtime_flags field. */
 #define	MPC_RUNTIME_FLAG_REGISTERED	0x00000001
 
-#define	MAC_POLICY_SET(mpents, mpname, mpfullname, mpflags, privdata_wanted) \
+#define	MAC_POLICY_SET(mpops, mpname, mpfullname, mpflags, privdata_wanted) \
 	static struct mac_policy_conf mpname##_mac_policy_conf = {	\
 		#mpname,						\
 		mpfullname,						\
-		NULL,							\
-		mpents,							\
+		mpops,							\
 		mpflags,						\
 		privdata_wanted,					\
 		0,							\
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 5c3da06b452b..4882c0f46d2c 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -471,595 +471,16 @@ static int
 mac_policy_register(struct mac_policy_conf *mpc)
 {
 	struct mac_policy_conf *tmpc;
-	struct mac_policy_op_entry *mpe;
 	int slot;
 
-	MALLOC(mpc->mpc_ops, struct mac_policy_ops *, sizeof(*mpc->mpc_ops),
-	    M_MACOPVEC, M_WAITOK | M_ZERO);
-	for (mpe = mpc->mpc_entries; mpe->mpe_constant != MAC_OP_LAST; mpe++) {
-		switch (mpe->mpe_constant) {
-		case MAC_OP_LAST:
-			/*
-			 * Doesn't actually happen, but this allows checking
-			 * that all enumerated values are handled.
-			 */
-			break;
-		case MAC_DESTROY:
-			mpc->mpc_ops->mpo_destroy =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT:
-			mpc->mpc_ops->mpo_init =
-			    mpe->mpe_function;
-			break;
-		case MAC_SYSCALL:
-			mpc->mpc_ops->mpo_syscall =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_init_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_CRED_LABEL:
-			mpc->mpc_ops->mpo_init_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_init_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IFNET_LABEL:
-			mpc->mpc_ops->mpo_init_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_IPQ_LABEL:
-			mpc->mpc_ops->mpo_init_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MBUF_LABEL:
-			mpc->mpc_ops->mpo_init_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_init_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_init_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_PIPE_LABEL:
-			mpc->mpc_ops->mpo_init_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_init_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_init_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INIT_VNODE_LABEL:
-			mpc->mpc_ops->mpo_init_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_BPFDESC_LABEL:
-			mpc->mpc_ops->mpo_destroy_bpfdesc_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_CRED_LABEL:
-			mpc->mpc_ops->mpo_destroy_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_DEVFSDIRENT_LABEL:
-			mpc->mpc_ops->mpo_destroy_devfsdirent_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IFNET_LABEL:
-			mpc->mpc_ops->mpo_destroy_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_IPQ_LABEL:
-			mpc->mpc_ops->mpo_destroy_ipq_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MBUF_LABEL:
-			mpc->mpc_ops->mpo_destroy_mbuf_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_MOUNT_FS_LABEL:
-			mpc->mpc_ops->mpo_destroy_mount_fs_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_destroy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_destroy_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_DESTROY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_destroy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_PIPE_LABEL:
-			mpc->mpc_ops->mpo_copy_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_COPY_VNODE_LABEL:
-			mpc->mpc_ops->mpo_copy_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_externalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_externalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_externalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_SOCKET_PEER_LABEL:
-			mpc->mpc_ops->mpo_externalize_socket_peer_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_externalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_CRED_LABEL:
-			mpc->mpc_ops->mpo_internalize_cred_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_IFNET_LABEL:
-			mpc->mpc_ops->mpo_internalize_ifnet_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_PIPE_LABEL:
-			mpc->mpc_ops->mpo_internalize_pipe_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_SOCKET_LABEL:
-			mpc->mpc_ops->mpo_internalize_socket_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_INTERNALIZE_VNODE_LABEL:
-			mpc->mpc_ops->mpo_internalize_vnode_label =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DEVICE:
-			mpc->mpc_ops->mpo_create_devfs_device =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_DIRECTORY:
-			mpc->mpc_ops->mpo_create_devfs_directory =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_SYMLINK:
-			mpc->mpc_ops->mpo_create_devfs_symlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DEVFS_VNODE:
-			mpc->mpc_ops->mpo_create_devfs_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MOUNT:
-			mpc->mpc_ops->mpo_create_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_ROOT_MOUNT:
-			mpc->mpc_ops->mpo_create_root_mount =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_VNODE:
-			mpc->mpc_ops->mpo_relabel_vnode =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_DEVFSDIRENT:
-			mpc->mpc_ops->mpo_update_devfsdirent =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_DEVFS:
-			mpc->mpc_ops->mpo_associate_vnode_devfs =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_associate_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_ASSOCIATE_VNODE_SINGLELABEL:
-			mpc->mpc_ops->mpo_associate_vnode_singlelabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_create_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_SETLABEL_VNODE_EXTATTR:
-			mpc->mpc_ops->mpo_setlabel_vnode_extattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_mbuf_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PIPE:
-			mpc->mpc_ops->mpo_create_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET:
-			mpc->mpc_ops->mpo_create_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_SOCKET_FROM_SOCKET:
-			mpc->mpc_ops->mpo_create_socket_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_PIPE:
-			mpc->mpc_ops->mpo_relabel_pipe =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_SOCKET:
-			mpc->mpc_ops->mpo_relabel_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_MBUF:
-			mpc->mpc_ops->mpo_set_socket_peer_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_SET_SOCKET_PEER_FROM_SOCKET:
-			mpc->mpc_ops->mpo_set_socket_peer_from_socket =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_BPFDESC:
-			mpc->mpc_ops->mpo_create_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_DATAGRAM_FROM_IPQ:
-			mpc->mpc_ops->mpo_create_datagram_from_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_FRAGMENT:
-			mpc->mpc_ops->mpo_create_fragment =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IFNET:
-			mpc->mpc_ops->mpo_create_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_IPQ:
-			mpc->mpc_ops->mpo_create_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_MBUF:
-			mpc->mpc_ops->mpo_create_mbuf_from_mbuf =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_LINKLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_linklayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_BPFDESC:
-			mpc->mpc_ops->mpo_create_mbuf_from_bpfdesc =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_FROM_IFNET:
-			mpc->mpc_ops->mpo_create_mbuf_from_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_MULTICAST_ENCAP:
-			mpc->mpc_ops->mpo_create_mbuf_multicast_encap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_MBUF_NETLAYER:
-			mpc->mpc_ops->mpo_create_mbuf_netlayer =
-			    mpe->mpe_function;
-			break;
-		case MAC_FRAGMENT_MATCH:
-			mpc->mpc_ops->mpo_fragment_match =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_IFNET:
-			mpc->mpc_ops->mpo_relabel_ifnet =
-			    mpe->mpe_function;
-			break;
-		case MAC_UPDATE_IPQ:
-			mpc->mpc_ops->mpo_update_ipq =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_CRED:
-			mpc->mpc_ops->mpo_create_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_TRANSITION:
-			mpc->mpc_ops->mpo_execve_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_EXECVE_WILL_TRANSITION:
-			mpc->mpc_ops->mpo_execve_will_transition =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC0:
-			mpc->mpc_ops->mpo_create_proc0 =
-			    mpe->mpe_function;
-			break;
-		case MAC_CREATE_PROC1:
-			mpc->mpc_ops->mpo_create_proc1 =
-			    mpe->mpe_function;
-			break;
-		case MAC_RELABEL_CRED:
-			mpc->mpc_ops->mpo_relabel_cred =
-			    mpe->mpe_function;
-			break;
-		case MAC_THREAD_USERRET:
-			mpc->mpc_ops->mpo_thread_userret =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_BPFDESC_RECEIVE:
-			mpc->mpc_ops->mpo_check_bpfdesc_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_RELABEL:
-			mpc->mpc_ops->mpo_check_cred_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_CRED_VISIBLE:
-			mpc->mpc_ops->mpo_check_cred_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_RELABEL:
-			mpc->mpc_ops->mpo_check_ifnet_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_IFNET_TRANSMIT:
-			mpc->mpc_ops->mpo_check_ifnet_transmit =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_MOUNT_STAT:
-			mpc->mpc_ops->mpo_check_mount_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_IOCTL:
-			mpc->mpc_ops->mpo_check_pipe_ioctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_POLL:
-			mpc->mpc_ops->mpo_check_pipe_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_READ:
-			mpc->mpc_ops->mpo_check_pipe_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_RELABEL:
-			mpc->mpc_ops->mpo_check_pipe_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_STAT:
-			mpc->mpc_ops->mpo_check_pipe_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PIPE_WRITE:
-			mpc->mpc_ops->mpo_check_pipe_write =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_DEBUG:
-			mpc->mpc_ops->mpo_check_proc_debug =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SCHED:
-			mpc->mpc_ops->mpo_check_proc_sched =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_PROC_SIGNAL:
-			mpc->mpc_ops->mpo_check_proc_signal =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_BIND:
-			mpc->mpc_ops->mpo_check_socket_bind =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_CONNECT:
-			mpc->mpc_ops->mpo_check_socket_connect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_DELIVER:
-			mpc->mpc_ops->mpo_check_socket_deliver =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_LISTEN:
-			mpc->mpc_ops->mpo_check_socket_listen =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RECEIVE:
-			mpc->mpc_ops->mpo_check_socket_receive =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_RELABEL:
-			mpc->mpc_ops->mpo_check_socket_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_SEND:
-			mpc->mpc_ops->mpo_check_socket_send =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SOCKET_VISIBLE:
-			mpc->mpc_ops->mpo_check_socket_visible =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_REBOOT:
-			mpc->mpc_ops->mpo_check_system_reboot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SWAPON:
-			mpc->mpc_ops->mpo_check_system_swapon =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_SYSTEM_SYSCTL:
-			mpc->mpc_ops->mpo_check_system_sysctl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_ACCESS:
-			mpc->mpc_ops->mpo_check_vnode_access =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHDIR:
-			mpc->mpc_ops->mpo_check_vnode_chdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CHROOT:
-			mpc->mpc_ops->mpo_check_vnode_chroot =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_CREATE:
-			mpc->mpc_ops->mpo_check_vnode_create =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETE:
-			mpc->mpc_ops->mpo_check_vnode_delete =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_DELETEACL:
-			mpc->mpc_ops->mpo_check_vnode_deleteacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_EXEC:
-			mpc->mpc_ops->mpo_check_vnode_exec =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETACL:
-			mpc->mpc_ops->mpo_check_vnode_getacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_GETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_getextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LINK:
-			mpc->mpc_ops->mpo_check_vnode_link =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_LOOKUP:
-			mpc->mpc_ops->mpo_check_vnode_lookup =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP:
-			mpc->mpc_ops->mpo_check_vnode_mmap =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MMAP_DOWNGRADE:
-			mpc->mpc_ops->mpo_check_vnode_mmap_downgrade =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_MPROTECT:
-			mpc->mpc_ops->mpo_check_vnode_mprotect =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_OPEN:
-			mpc->mpc_ops->mpo_check_vnode_open =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_POLL:
-			mpc->mpc_ops->mpo_check_vnode_poll =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READ:
-			mpc->mpc_ops->mpo_check_vnode_read =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READDIR:
-			mpc->mpc_ops->mpo_check_vnode_readdir =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_READLINK:
-			mpc->mpc_ops->mpo_check_vnode_readlink =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RELABEL:
-			mpc->mpc_ops->mpo_check_vnode_relabel =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_FROM:
-			mpc->mpc_ops->mpo_check_vnode_rename_from =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_RENAME_TO:
-			mpc->mpc_ops->mpo_check_vnode_rename_to =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_REVOKE:
-			mpc->mpc_ops->mpo_check_vnode_revoke =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETACL:
-			mpc->mpc_ops->mpo_check_vnode_setacl =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETEXTATTR:
-			mpc->mpc_ops->mpo_check_vnode_setextattr =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETFLAGS:
-			mpc->mpc_ops->mpo_check_vnode_setflags =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETMODE:
-			mpc->mpc_ops->mpo_check_vnode_setmode =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETOWNER:
-			mpc->mpc_ops->mpo_check_vnode_setowner =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_SETUTIMES:
-			mpc->mpc_ops->mpo_check_vnode_setutimes =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_STAT:
-			mpc->mpc_ops->mpo_check_vnode_stat =
-			    mpe->mpe_function;
-			break;
-		case MAC_CHECK_VNODE_WRITE:
-			mpc->mpc_ops->mpo_check_vnode_write =
-			    mpe->mpe_function;
-			break;
-/*
-		default:
-			printf("MAC policy `%s': unknown operation %d\n",
-			    mpc->mpc_name, mpe->mpe_constant);
-			return (EINVAL);
-*/
-		}
-	}
 	MAC_POLICY_LIST_LOCK();
 	if (mac_policy_list_busy > 0) {
 		MAC_POLICY_LIST_UNLOCK();
-		FREE(mpc->mpc_ops, M_MACOPVEC);
-		mpc->mpc_ops = NULL;
 		return (EBUSY);
 	}
 	LIST_FOREACH(tmpc, &mac_policy_list, mpc_list) {
 		if (strcmp(tmpc->mpc_name, mpc->mpc_name) == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (EEXIST);
 		}
 	}
@@ -1067,8 +488,6 @@ mac_policy_register(struct mac_policy_conf *mpc)
 		slot = ffs(mac_policy_offsets_free);
 		if (slot == 0) {
 			MAC_POLICY_LIST_UNLOCK();
-			FREE(mpc->mpc_ops, M_MACOPVEC);
-			mpc->mpc_ops = NULL;
 			return (ENOMEM);
 		}
 		slot--;
@@ -1135,8 +554,6 @@ mac_policy_unregister(struct mac_policy_conf *mpc)
 	LIST_REMOVE(mpc, mpc_list);
 	MAC_POLICY_LIST_UNLOCK();
 
-	FREE(mpc->mpc_ops, M_MACOPVEC);
-	mpc->mpc_ops = NULL;
 	mpc->mpc_runtime_flags &= ~MPC_RUNTIME_FLAG_REGISTERED;
 
 	printf("Security policy unload: %s (%s)\n", mpc->mpc_fullname,