9 files changed, 167 insertions, 332 deletions

diff --git a/sys/security/mac/mac_framework.c b/sys/security/mac/mac_framework.c
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_framework.c
+++ b/sys/security/mac/mac_framework.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\
diff --git a/sys/security/mac/mac_internal.h b/sys/security/mac/mac_internal.h
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_internal.h
+++ b/sys/security/mac/mac_internal.h
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\
diff --git a/sys/security/mac/mac_net.c b/sys/security/mac/mac_net.c
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_net.c
+++ b/sys/security/mac/mac_net.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\
diff --git a/sys/security/mac/mac_pipe.c b/sys/security/mac/mac_pipe.c
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_pipe.c
+++ b/sys/security/mac/mac_pipe.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\
diff --git a/sys/security/mac/mac_policy.h b/sys/security/mac/mac_policy.h
index 878b961ab281..b1f7a4329f10 100644
--- a/sys/security/mac/mac_policy.h
+++ b/sys/security/mac/mac_policy.h
@@ -60,6 +60,7 @@ struct mac_policy_conf;
 struct mbuf;
 struct mount;
 struct pipe;
+struct sbuf;
 struct socket;
 struct ucred;
 struct uio;
@@ -114,23 +115,17 @@ struct mac_policy_ops {
 	void	(*mpo_copy_vnode_label)(struct label *src,
 		    struct label *dest);
 	int	(*mpo_externalize_cred_label)(struct label *label,
-		    char *element_name, char *buffer, size_t buflen,
-		    size_t *len, int *claimed);
+		    char *element_name, struct sbuf *sb, int *claimed);
 	int	(*mpo_externalize_ifnet_label)(struct label *label,
-		    char *element_name, char *buffer, size_t buflen,
-		    size_t *len, int *claimed);
+		    char *element_name, struct sbuf *sb, int *claimed);
 	int	(*mpo_externalize_pipe_label)(struct label *label,
-		    char *element_name, char *buffer, size_t buflen,
-		    size_t *len, int *claimed);
+		    char *element_name, struct sbuf *sb, int *claimed);
 	int	(*mpo_externalize_socket_label)(struct label *label,
-		    char *element_name, char *buffer, size_t buflen,
-		    size_t *len, int *claimed);
+		    char *element_name, struct sbuf *sb, int *claimed);
 	int	(*mpo_externalize_socket_peer_label)(struct label *label,
-		    char *element_name, char *buffer, size_t buflen,
-		    size_t *len, int *claimed);
+		    char *element_name, struct sbuf *sb, int *claimed);
 	int	(*mpo_externalize_vnode_label)(struct label *label,
-		    char *element_name, char *buffer, size_t buflen,
-		    size_t *len, int *claimed);
+		    char *element_name, struct sbuf *sb, int *claimed);
 	int	(*mpo_internalize_cred_label)(struct label *label,
 		    char *element_name, char *element_data, int *claimed);
 	int	(*mpo_internalize_ifnet_label)(struct label *label,
diff --git a/sys/security/mac/mac_process.c b/sys/security/mac/mac_process.c
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_process.c
+++ b/sys/security/mac/mac_process.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\
diff --git a/sys/security/mac/mac_syscalls.c b/sys/security/mac/mac_syscalls.c
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_syscalls.c
+++ b/sys/security/mac/mac_syscalls.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\
diff --git a/sys/security/mac/mac_system.c b/sys/security/mac/mac_system.c
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_system.c
+++ b/sys/security/mac/mac_system.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\
diff --git a/sys/security/mac/mac_vfs.c b/sys/security/mac/mac_vfs.c
index 79a12ec7c7c5..0d6bf29497cd 100644
--- a/sys/security/mac/mac_vfs.c
+++ b/sys/security/mac/mac_vfs.c
@@ -56,6 +56,7 @@ __FBSDID("$FreeBSD$");
 #include <sys/mac.h>
 #include <sys/module.h>
 #include <sys/proc.h>
+#include <sys/sbuf.h>
 #include <sys/systm.h>
 #include <sys/sysproto.h>
 #include <sys/sysent.h>
@@ -398,65 +399,44 @@ mac_policy_list_unbusy(void)
 
 #define	MAC_EXTERNALIZE(type, label, elementlist, outbuf, 		\
     outbuflen) do {							\
-	char *curptr, *curptr_start, *element_name, *element_temp;	\
-	size_t left, left_start, len;					\
-	int claimed, first, first_start, ignorenotfound;		\
+	int claimed, first, ignorenotfound, savedlen;			\
+	char *element_name, *element_temp;				\
+	struct sbuf sb;							\
 									\
 	error = 0;							\
-	element_temp = elementlist;					\
-	curptr = outbuf;						\
-	curptr[0] = '\0';						\
-	left = outbuflen;						\
 	first = 1;							\
+	sbuf_new(&sb, outbuf, outbuflen, SBUF_FIXEDLEN);		\
+	element_temp = elementlist;					\
 	while ((element_name = strsep(&element_temp, ",")) != NULL) {	\
-		curptr_start = curptr;					\
-		left_start = left;					\
-		first_start = first;					\
 		if (element_name[0] == '?') {				\
 			element_name++;					\
 			ignorenotfound = 1;				\
-		} else							\
+		 } else							\
 			ignorenotfound = 0;				\
-		claimed = 0;						\
+		savedlen = sbuf_len(&sb);				\
 		if (first) {						\
-			len = snprintf(curptr, left, "%s/",		\
-			    element_name);				\
+			error = sbuf_printf(&sb, "%s/", element_name);	\
 			first = 0;					\
 		} else							\
-			len = snprintf(curptr, left, ",%s/",		\
-			    element_name);				\
-		if (len >= left) {					\
-			error = EINVAL;		/* XXXMAC: E2BIG */	\
+			error = sbuf_printf(&sb, ",%s/", element_name);	\
+		if (error == -1) {					\
+			error = EINVAL;	/* XXX: E2BIG? */		\
 			break;						\
 		}							\
-		curptr += len;						\
-		left -= len;						\
-									\
+		claimed = 0;						\
 		MAC_CHECK(externalize_ ## type, label, element_name,	\
-		    curptr, left, &len, &claimed);			\
+		    &sb, &claimed);					\
 		if (error)						\
 			break;						\
-		if (claimed == 1) {					\
-			if (len >= outbuflen) {				\
-				error = EINVAL;	/* XXXMAC: E2BIG */	\
-				break;					\
-			}						\
-			curptr += len;					\
-			left -= len;					\
-		} else if (claimed == 0 && ignorenotfound) {		\
-			/*						\
-			 * Revert addition of the label element		\
-			 * name.					\
-			 */						\
-			curptr = curptr_start;				\
-			*curptr = '\0';					\
-			left = left_start;				\
-			first = first_start;				\
-		} else {						\
-			error = EINVAL;		/* XXXMAC: ENOLABEL */	\
+		if (claimed == 0 && ignorenotfound) {			\
+			/* Revert last label name. */			\
+			sbuf_setpos(&sb, savedlen);			\
+		} else if (claimed != 1) {				\
+			error = EINVAL;	/* XXX: ENOLABEL? */		\
 			break;						\
 		}							\
 	}								\
+	sbuf_finish(&sb);						\
 } while (0)
 
 #define	MAC_INTERNALIZE(type, label, instring) do {			\